Unscored severity · published Aug 27, 2014
CVE-2014-3596
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…
–
CVSS
9.2%
EPSS
No
On KEV
Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AX
Axis · Apache
through 1.4; 1.0; 1.0; 1.0; 1.0; 1.1; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3596
linux.oracle.com
http://linux.oracle.com/errata/ELSA-2014-1193.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1193.html
secunia.com
http://secunia.com/advisories/61222
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/08/20/2
More from Axis
9.8
CVE-2023-40743
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService"…
7.5
CVE-2019-0227
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006
7.2
CVE-2023-51441
** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects…
6.1
CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services
–
CVE-2012-5784
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ,…