PT-2012-6129 · Codehaus · Xfire

Published 2012-11-04 · Updated 2024-02-14 · CVE-2012-5817

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Codehaus XFire versions 1.2.6 and earlier

Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate.

Recommendations For Codehaus XFire versions 1.2.6 and earlier, consider implementing certificate validation to ensure the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate as a temporary workaround until a patch is available.

Exploit

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

CVE-2012-5817

GHSA-5JC8-8XHV-G8QM

Affected Products

Xfire

References · 4

• 🔥 http://cs.utexas.edu/~shmat/shmat_ccs12.pdf · Exploit
• https://osv.dev/vulnerability/GHSA-5jc8-8xhv-g8qm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5817 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79934 · Note