« Volver al listado

CVE-2012-5781

Estado: ModificadaMedia (5.8)—

Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Amazon — Elastic Load Balancing

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-5781",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-11-04T22:55:03.153",
  "references": [
    {
      "url": "http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager."
    },
    {
      "lang": "es",
      "value": "Amazon Elastic Load Balancing API Tools, no comprueba que el nombre del servidor coincide con un nombre de dominio en el nombre común (CN) del sujeto o con el campo subjectAltName del certificado X.509, lo que permite falsificar servidores SSL a atacantes man-in-the-middle mediante un certificado válido de su elección. Se trata de un problema relacionado con una sobre-escritura del X509TrustManager del JDK por defecto."
    }
  ],
  "lastModified": "2026-06-16T23:47:19.423",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75705570-F4E0-43A2-BD59-FFE3B82DED27"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9215BCAC-FD23-443C-A21D-7DD21FF10223"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0:1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F5ABE81-C562-41E0-82EB-301E0A20D852"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4BC34FF-EDE2-4C56-9A42-7F6D1EB0EDB6"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08D121A6-D139-499B-91E4-E7DFC901BCB7"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A55A66C-F50A-4504-AF0D-206E32A4EAF4"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.11.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "278FDECB-E372-4ACC-9DE4-2BA1C504ED41"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E199D1F3-422F-4F51-9072-A91CC2EA1546"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.14.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B307BB61-D9B3-4021-9C45-778B660A04B4"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82976DEA-302D-44F0-A4B8-D0991514FB46"
            },
            {
              "criteria": "cpe:2.3:a:amazon:elastic_load_balancing:1.0.17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23151441-865A-4C3B-BF2A-9295493AFBB8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}