Read the docs
TI-2012-04825 Aliases CVE-2012-5784GHSA-55w9-c3g2-4rrh

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal…

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Why it matters now

EPSS 0.05722 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 4 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.axis:axis (Maven)up to 1.4—No fix listedGHSA-55w9-c3g2-4rrh
—axis:axis (Maven)up to 1.4—No fix listedGHSA-55w9-c3g2-4rrh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.axis:axis (Maven) Vendor— Affected up to 1.4 Fixed in — No fix listed GHSA-55w9-c3g2-4rrh
  • axis:axis (Maven) Vendor— Affected up to 1.4 Fixed in — No fix listed GHSA-55w9-c3g2-4rrh

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*up to 5.7.0VulnerableApache
cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*up to 1.4VulnerableApache
cpe:2.3:a:apache:axis:-:alpha1:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:-:alpha2:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:-:alpha3:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:-:beta1:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:-:beta2:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:-:beta3:*:*:*:*:*:*not specified by NVDVulnerableApache
cpe:2.3:a:apache:axis:1.0:*:*:*:*:*:*:*1.0VulnerableApache
cpe:2.3:a:apache:axis:1.0:beta:*:*:*:*:*:*1.0 betaVulnerableApache
  • cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions up to 5.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:* Versions up to 1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:alpha1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:alpha2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:alpha3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:beta1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:beta2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:-:beta3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.0:beta:*:*:*:*:*:* Versions 1.0 beta Vulnerable ·Apache
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:axis:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableApache
cpe:2.3:a:apache:axis:1.0:rc2:*:*:*:*:*:*1.0 rc2VulnerableApache
cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:axis:1.1:beta:*:*:*:*:*:*1.1 betaVulnerableApache
cpe:2.3:a:apache:axis:1.1:rc1:*:*:*:*:*:*1.1 rc1VulnerableApache
cpe:2.3:a:apache:axis:1.1:rc2:*:*:*:*:*:*1.1 rc2VulnerableApache
cpe:2.3:a:apache:axis:1.2:*:*:*:*:*:*:*1.2VulnerableApache
cpe:2.3:a:apache:axis:1.2:alpha:*:*:*:*:*:*1.2 alphaVulnerableApache
cpe:2.3:a:apache:axis:1.2:beta1:*:*:*:*:*:*1.2 beta1VulnerableApache
cpe:2.3:a:apache:axis:1.2:beta2:*:*:*:*:*:*1.2 beta2VulnerableApache
cpe:2.3:a:apache:axis:1.2:beta3:*:*:*:*:*:*1.2 beta3VulnerableApache
cpe:2.3:a:apache:axis:1.2:rc1:*:*:*:*:*:*1.2 rc1VulnerableApache
cpe:2.3:a:apache:axis:1.2:rc2:*:*:*:*:*:*1.2 rc2VulnerableApache
cpe:2.3:a:apache:axis:1.2:rc3:*:*:*:*:*:*1.2 rc3VulnerableApache
cpe:2.3:a:apache:axis:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableApache
cpe:2.3:a:apache:axis:1.3:*:*:*:*:*:*:*1.3VulnerableApache
cpe:2.3:a:paypal:mass_pay:-:*:*:*:*:*:*:*not specified by NVDVulnerablePayPal
cpe:2.3:a:paypal:payments_pro:-:*:*:*:*:*:*:*not specified by NVDVulnerablePayPal
cpe:2.3:a:paypal:transactional_information_soap:-:*:*:*:*:*:*:*not specified by NVDVulnerablePayPal
  • cpe:2.3:a:apache:axis:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.0:rc2:*:*:*:*:*:* Versions 1.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.1:beta:*:*:*:*:*:* Versions 1.1 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.1:rc1:*:*:*:*:*:* Versions 1.1 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.1:rc2:*:*:*:*:*:* Versions 1.1 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:alpha:*:*:*:*:*:* Versions 1.2 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:beta1:*:*:*:*:*:* Versions 1.2 beta1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:beta2:*:*:*:*:*:* Versions 1.2 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:beta3:*:*:*:*:*:* Versions 1.2 beta3 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:rc1:*:*:*:*:*:* Versions 1.2 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:rc2:*:*:*:*:*:* Versions 1.2 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2:rc3:*:*:*:*:*:* Versions 1.2 rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:axis:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Apache
  • cpe:2.3:a:paypal:mass_pay:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PayPal
  • cpe:2.3:a:paypal:payments_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PayPal
  • cpe:2.3:a:paypal:transactional_information_soap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·PayPal

Remediation

Red Hat 4 advisories

  • RHSA-2014:1123 Released 2014-09-02 · Red Hat rating Moderate
    devtoolset-2-axis security update
    • Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Server devtoolset-2-axis-1.4-23.el6
    • Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 Workstation devtoolset-2-axis-1.4-23.el6
  • RHSA-2014:0037 Released 2014-01-21 · Red Hat rating Moderate
    jasperreports-server-pro security, bug fix, and enhancement update
    • RHEV-M 3.3 jasperreports-server-pro-5.5.0-4.el6ev
  • RHSA-2013:0683 Released 2013-03-25 · Red Hat rating Moderate
    axis security update
    • Red Hat Enterprise Linux (v. 5 server) axis-1.2.1-2jpp.7.el5_9, axis-1.2.1-2jpp.7.el5_9.i386, axis-1.2.1-2jpp.7.el5_9.ia64 +9
Show 1 more Red Hat advisories
  • RHSA-2013:0269 Released 2013-02-19 · Red Hat rating Moderate
    axis security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) axis-1.2.1-7.3.el6_3, axis-javadoc-1.2.1-7.3.el6_3, axis-manual-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux HPC Node (v. 6) axis-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) axis-1.2.1-7.3.el6_3, axis-javadoc-1.2.1-7.3.el6_3, axis-manual-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux Server (v. 6) axis-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux Server Optional (v. 6) axis-1.2.1-7.3.el6_3, axis-javadoc-1.2.1-7.3.el6_3, axis-manual-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux Workstation (v. 6) axis-1.2.1-7.3.el6_3
    • Red Hat Enterprise Linux Workstation Optional (v. 6) axis-1.2.1-7.3.el6_3, axis-javadoc-1.2.1-7.3.el6_3, axis-manual-1.2.1-7.3.el6_3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
RHEV-M 3.3Fixed RHSA-2014:0037
Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 ServerFixed RHSA-2014:1123
Red Hat Developer Toolset 2 for Red Hat Enterprise Linux 6 WorkstationFixed RHSA-2014:1123
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2013:0683
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2013:0269
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2013:0269

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5784
  2. 2026-10-03 Alias added: GHSA-55w9-c3g2-4rrh

References

Exploit 1

Advisory 6

Other 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences