CVE-2012-5781
Severity Score
5.8
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager.
Amazon Elastic Load Balancing API Tools, no comprueba que el nombre del servidor coincide con un nombre de dominio en el nombre común (CN) del sujeto o con el campo subjectAltName del certificado X.509, lo que permite falsificar servidores SSL a atacantes man-in-the-middle mediante un certificado válido de su elección. Se trata de un problema relacionado con una sobre-escritura del X509TrustManager del JDK por defecto.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-11-04 CVE Reserved
- 2012-11-04 CVE Published
- 2024-09-17 CVE Updated
- 2024-09-17 First Exploit
- 2024-11-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf | 2024-09-17 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | - | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0" | 1 |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.3.4 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.3.4" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.9.3 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.9.3" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.10.0 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.10.0" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.11.1 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.11.1" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.12.0 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.12.0" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.14.3 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.14.3" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.15.1 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.15.1" | - |
Affected
| ||||||
| Amazon Search vendor "Amazon" | Elastic Load Balancing Search vendor "Amazon" for product "Elastic Load Balancing" | 1.0.17.0 Search vendor "Amazon" for product "Elastic Load Balancing" and version "1.0.17.0" | - |
Affected
| ||||||