CVE-2012-5817: amazon ec2_api_tools_java_library Improper Certificate Validation
Vulnerability summary
CVE-2012-5817 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in amazon ec2_api_tools_java_library. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-11-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (cs.utexas.edu)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
3 vendors · 3 products
