CVE-2014-3596
apache axis: no CVSS score yet. EPSS 9.2% chance of exploitation in the next 30 days.
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
- EPSS
- 9.2% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:axis
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r53v-vm87-f72c | Maven | org.apache.axis:axis | <=1.4 | no fix published |
| GHSA-r53v-vm87-f72c | Maven | axis:axis | <=1.4 | no fix published |