Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3596

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Published

2014-08-27T00:55:05.160

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache axis ≤ 1.4 Yes
Application apache axis 1.0 Yes
Application apache axis 1.0 Yes
Application apache axis 1.0 Yes
Application apache axis 1.0 Yes
Application apache axis 1.1 Yes
Application apache axis 1.1 Yes
Application apache axis 1.1 Yes
Application apache axis 1.1 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2 Yes
Application apache axis 1.2.1 Yes
Application apache axis 1.3 Yes
References