CVE-2012-5887
At a glance
- Source
- NVD
- EPSS
- EPSS 12.10 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Analyzed
Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21626891
- http://secunia.com/advisories/51371
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- http://svn.apache.org/viewvc?view=revision&revision=1392248
- http://rhn.redhat.com/errata/RHSA-2013-0631.html
- http://rhn.redhat.com/errata/RHSA-2013-0640.html
- http://www.ubuntu.com/usn/USN-1637-1
- http://www.securityfocus.com/bid/56403
- http://tomcat.apache.org/security-7.html
- http://rhn.redhat.com/errata/RHSA-2013-0648.html
- http://rhn.redhat.com/errata/RHSA-2013-0633.html
- http://rhn.redhat.com/errata/RHSA-2013-0629.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79809
- http://rhn.redhat.com/errata/RHSA-2013-0647.html
- http://rhn.redhat.com/errata/RHSA-2013-0632.html
- http://tomcat.apache.org/security-6.html
- http://svn.apache.org/viewvc?view=revision&revision=1380829
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- http://rhn.redhat.com/errata/RHSA-2013-0623.html
- http://tomcat.apache.org/security-5.html
- http://svn.apache.org/viewvc?view=revision&revision=1377807
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- http://rhn.redhat.com/errata/RHSA-2013-0726.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-28cq-6rmx-pjq4 — Improper Authentication in Apache Tomcat
European references
- ENISA EUVD · EUVD-2022-1939
- GCVE · GCVE-0-2012-5887
CERT-FR advisories
- CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTA-2013-AVI-277 — Multiples vulnérabilités dans VMware · cert.ssi.gouv.fr
- CERTA-2013-AVI-145 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 5.5.0 < 5.5.36cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.36cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.30
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |