Maven package
org.apache.axis2/axis2
pkg:maven/org.apache.axis2/axis2
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2012-5785 | — | < 1.8.0 | 1.8.0 | Nov 4, 2012 | Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. | ||
| CVE-2012-5351 | — | < 1.6.4 | 1.6.4 | Oct 9, 2012 | Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418. | ||
| CVE-2012-4418 | — | < 1.7.9 | 1.7.9 | Oct 9, 2012 | Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack." |
- CVE-2012-5785Nov 4, 2012affected < 1.8.0fixed 1.8.0
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- CVE-2012-5351Oct 9, 2012affected < 1.6.4fixed 1.6.4
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
- CVE-2012-4418Oct 9, 2012affected < 1.7.9fixed 1.7.9
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."