Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2012-5783

25
FAUCET Score

CVE-2012-5783 describes a vulnerability in Apache Commons HttpClient 3.x, affecting products like the Amazon FPS merchant Java SDK, where the software fails to properly validate SSL server hostnames against X.509 certificate fields. This flaw allows man-in-the-middle attackers to spoof SSL servers using any valid certificate. The vulnerability has a CVSS score of 5.8, indicating a medium severity with a network attack vector, medium attack complexity, and potential for partial confidentiality and integrity impact. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
3.1CPE matchmatch criteria
cpe:2.3:a:apache:httpclient:3.1:*:*:*:*:*:*:*
12.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
15.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

5.8MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
4.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
9.25%
Probability of exploitation in next 30 days
EPSS Percentile
94.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0925 is in the 94th percentile among its peer group of 19,954 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

redhatpatch availablevia redhat_api
Product: JBEWP 5 for RHEL 5Fixed in: jakarta-commons-httpclient-1:3.1-2.1_patch_01.ep5.el5
View patch
redhatpatch availablevia redhat_api
Product: JBEWP 5 for RHEL 6Fixed in: jakarta-commons-httpclient-1:3.1-2_patch_01.ep5.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Enterprise BRMS Platform 5.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: jakarta-commons-httpclient-1:3.0-7jpp.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: jakarta-commons-httpclient-1:3.1-0.7.el6_3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse 7.12
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss A-MQ 6.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 5.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 5 for RHEL 4Fixed in: jakarta-commons-httpclient-1:3.1-2.1_patch_01.ep5.el4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 5 for RHEL 5Fixed in: jakarta-commons-httpclient-1:3.1-2.1_patch_01.ep5.el5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 5 for RHEL 6Fixed in: jakarta-commons-httpclient-1:3.1-2_patch_01.ep5.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse 6.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Operations Network 3.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss SOA Platform 5.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Framework Kit 2.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Platform 5.2
View patch
redhatpatch availablevia redhat_api
Product: RHEV Manager version 3.3Fixed in: redhat-support-plugin-rhev-0:3.3.0-14.el6ev
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss BRMS 5Fixed in: jakarta-commons-httpclient
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse 6Fixed in: apache-commons-httpclient
redhatno patchvia redhat_api
Product: Red Hat JBoss Operations Network 3Fixed in: jakarta-commons-httpclient
redhatno patchvia redhat_api
Product: Red Hat JBoss SOA Platform 5Fixed in: jakarta-commons-httpclient
redhatend of lifevia redhat_api
Product: Red Hat JBoss Portal 4Fixed in: jakarta-commons-httpclient
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 1Fixed in: jakarta-commons-httpclient
redhatend of lifevia redhat_api
Product: Red Hat JBoss Portal 5Fixed in: jakarta-commons-httpclient
redhatend of lifevia redhat_api
Product: Red Hat JBoss SOA Platform 4Fixed in: jakarta-commons-httpclient

Vendor Advisories (2)

mavenGHSA-3832-9276-x7gfmedium

Improper Certificate Validation in Apache Commons HttpClient

May 13, 2022
redhatCVE-2012-5783Moderate

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

Oct 16, 2012

References

lists.opensuse.org / opensuse-updates/2013-02/msg00078.html
Broken Link
lists.opensuse.org / opensuse-updates/2013-04/msg00040.html
Broken Link
lists.opensuse.org / opensuse-updates/2013-04/msg00041.html
Broken Link
lists.opensuse.org / opensuse-updates/2013-04/msg00053.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-0270.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-0679.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-0680.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-0681.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-0682.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-1147.html
Broken Link
rhn.redhat.com / errata/RHSA-2013-1853.html
Broken Link
rhn.redhat.com / errata/RHSA-2014-0224.html
Broken Link
access.redhat.com / errata/RHSA-2017:0868
Third Party Advisory
exchange.xforce.ibmcloud.com / vulnerabilities/79984
Third Party AdvisoryVDB Entry
issues.apache.org / jira/browse/HTTPCLIENT-1265
Issue TrackingPatchVendor Advisory
cs.utexas.edu / ~shmat/shmat_ccs12.pdf
Technical DescriptionThird Party Advisory
securityfocus.com / bid/58073
Third Party AdvisoryVDB Entry
ubuntu.com / usn/USN-2769-1
Third Party Advisory