CVE-2012-5887

Apache Tomcat 5.5.0-5.5.35 - Improper Authentication via Stale Nonce Bypass

Title source: llm

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

References (23)

Core 23

Core References

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21626891

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51371

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

Permissions Required x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1392248

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0631.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0640.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1637-1

Broken Link vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/56403

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-7.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0648.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0633.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0629.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/79809

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0647.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0632.html

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-6.html

Permissions Required x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1380829

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0623.html

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-5.html

Permissions Required x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1377807

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0726.html

Scores

EPSS 0.1210

EPSS Percentile 95.6%

Details

CWE

CWE-287

Status published

Products (2)

apache/tomcat 5.5.0 - 5.5.36

org.apache.tomcat/tomcat 5.5.0 - 5.5.36Maven

Published Nov 17, 2012

Tracked Since Feb 18, 2026