Lucene search

K
githubGitHub Advisory DatabaseGHSA-55W9-C3G2-4RRH
HistoryOct 07, 2020 - 5:51 p.m.

Man-in-the-middle attack in Apache Axis

2020-10-0717:51:02
CWE-20
GitHub Advisory Database
github.com
35

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

46.7%

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected configurations

Vulners
Node
axis\Matchaxis
OR
org.apache.axis\Matchaxis
CPENameOperatorVersion
axis:axisle1.4
org.apache.axis:axisle1.4

References

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

46.7%