CVE-2012-5783
đļ mediumSummary
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score
5.8
Medium
EPSS Score
0.7
Exploit Probability
Published Date
2012-11-04
First Seen: 2026-01-05
đ Relative Risk Intelligence
This CVE is Lower Risk - more severe than 32.9% of all 329,456 vulnerabilities in our database.
#221,102
Below average severity
Severity Percentile
Last Modified
2025-04-11
Source
NVD đ
CWE IDs (Weakness Types)