CVE-2014-3596 @ Maven-axis:axis-1.2

[cxronen]

Vulnerable Package issue exists @ Maven-axis:axis-1.2 in branch master

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: 8da575ca-6c79-4d57-ae63-b0e053c9ba06
Branch: master
Application: BookStore_VSCode
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-297

---

Additional Info
Attack vector: NETWORK
Attack complexity: MEDIUM
Confidentiality impact: PARTIAL
Availability impact: NONE

---

References
Issue
Advisory
Patch
Commit