Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m27v-7mbm-nffc
Vulnerability ID VCID-m27v-7mbm-nffc
Aliases CVE-2012-5783
GHSA-3832-9276-x7gf
Summary Improper Certificate Validation in Apache Commons HttpClient Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Note that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpclient/4.0/) of the Apache HttpComponents HttpClient module.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-295 Improper Certificate Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
generic_textual MODERATE http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-0270.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-0679.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-0680.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-0682.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-1853.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2014-0224.html
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2017:0868
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-5783.json
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2012-5783
generic_textual MODERATE https://exchange.xforce.ibmcloud.com/vulnerabilities/79984
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3832-9276-x7gf
generic_textual MODERATE https://github.com/apache/httpcomponents-client
generic_textual MODERATE https://issues.apache.org/jira/browse/HTTPCLIENT-1265
cvssv2 5.8 https://nvd.nist.gov/vuln/detail/CVE-2012-5783
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2012-5783
generic_textual MODERATE http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
generic_textual MODERATE http://www.ubuntu.com/usn/USN-2769-1
Reference id Reference type URL
http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html
http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html
http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html
http://rhn.redhat.com/errata/RHSA-2013-0270.html
http://rhn.redhat.com/errata/RHSA-2013-0679.html
http://rhn.redhat.com/errata/RHSA-2013-0680.html
http://rhn.redhat.com/errata/RHSA-2013-0681.html
http://rhn.redhat.com/errata/RHSA-2013-0682.html
http://rhn.redhat.com/errata/RHSA-2013-1147.html
http://rhn.redhat.com/errata/RHSA-2013-1853.html
http://rhn.redhat.com/errata/RHSA-2014-0224.html
https://access.redhat.com/errata/RHSA-2017:0868
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-5783.json
https://api.first.org/data/v1/epss?cve=CVE-2012-5783
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783
https://exchange.xforce.ibmcloud.com/vulnerabilities/79984
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/httpcomponents-client
https://issues.apache.org/jira/browse/HTTPCLIENT-1265
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
http://www.securityfocus.com/bid/58073
http://www.ubuntu.com/usn/USN-2769-1
692442 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692442
873317 https://bugzilla.redhat.com/show_bug.cgi?id=873317
cpe:2.3:a:apache:httpclient:3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:httpclient:3.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
CVE-2012-5783 https://nvd.nist.gov/vuln/detail/CVE-2012-5783
GHSA-3832-9276-x7gf https://github.com/advisories/GHSA-3832-9276-x7gf
RHSA-2013:0270 https://access.redhat.com/errata/RHSA-2013:0270
RHSA-2013:0679 https://access.redhat.com/errata/RHSA-2013:0679
RHSA-2013:0680 https://access.redhat.com/errata/RHSA-2013:0680
RHSA-2013:0681 https://access.redhat.com/errata/RHSA-2013:0681
RHSA-2013:0682 https://access.redhat.com/errata/RHSA-2013:0682
RHSA-2013:0763 https://access.redhat.com/errata/RHSA-2013:0763
RHSA-2013:1006 https://access.redhat.com/errata/RHSA-2013:1006
RHSA-2013:1147 https://access.redhat.com/errata/RHSA-2013:1147
RHSA-2013:1853 https://access.redhat.com/errata/RHSA-2013:1853
RHSA-2014:0224 https://access.redhat.com/errata/RHSA-2014:0224
USN-2769-1 https://usn.ubuntu.com/2769-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-5783.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2012-5783
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.69838
EPSS Score 0.00616
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:11.553859+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/commons-httpclient/commons-httpclient/CVE-2012-5783.yml 38.0.0