CVE-2012-5886

Apache Tomcat 5.5.x < 5.5.36, 6.x < 6.0.36, 7.x < 7.0.30 - Authentication Bypass via Session ID

Title source: llm
STIX 2.1

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

References (23)

Core 23
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0631.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0629.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0623.html
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21626891
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51371
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0640.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1637-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/56403
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-7.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0648.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/80407
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0633.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0647.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0632.html
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-6.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-5.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0726.html

Scores

EPSS 0.0877
EPSS Percentile 94.5%

Details

CWE
CWE-287
Status published
Products (44)
apache/tomcat 5.5.0
apache/tomcat 5.5.1
apache/tomcat 5.5.2
apache/tomcat 5.5.3
apache/tomcat 5.5.4
apache/tomcat 5.5.5
apache/tomcat 5.5.6
apache/tomcat 5.5.7
apache/tomcat 5.5.8
apache/tomcat 5.5.9
... and 34 more
Published Nov 17, 2012
Tracked Since Feb 18, 2026