CVEs-PoC/2012/CVE-2012-5783.md

CVE-2012-5783

Description

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

POC

Reference

• http://www.ubuntu.com/usn/USN-2769-1
• http://www.ubuntu.com/usn/USN-2769-1

Github

• https://github.com/albfernandez/commons-httpclient-3