Unscored severity · published Nov 4, 2012
CVE-2012-5783
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain…
–
CVSS
9.2%
EPSS
No
On KEV
Description
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
Httpclient · Apache
3.1 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 15.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5783
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5783
Broken Link
http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html
Broken Link
http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html
Broken Link
http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
Broken Link
http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2013-0270.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2013-0679.html
More from Httpclient
9.8
CVE-2013-4366
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified…
9.1
CVE-2026-71290
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
7.5
CVE-2025-27820
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification
7.3
CVE-2026-40542
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
5.3
CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS