AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2014-3603

MEDIUM · CVSS 5.9 EPSS 0.84%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2019-04-04 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2014-3603
Severity
MEDIUM
CVSS
5.9
EPSS
0.84%
Java

Original Filing — NVD Description

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.