5
CVSSv2

CVE-2012-5887

Published: 17/11/2012 Updated: 29/08/2017
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x prior to 5.5.36, 6.x prior to 6.0.36, and 7.x prior to 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Affected Products

Vendor Product Versions
ApacheTomcat5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.5.23, 5.5.24, 5.5.25, 5.5.26, 5.5.27, 5.5.28, 5.5.29, 5.5.30, 5.5.31, 5.5.32, 5.5.33, 5.5.34, 5.5.35, 6.0, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.0.16, 6.0.17, 6.0.18, 6.0.19, 6.0.20, 6.0.24, 6.0.26, 6.0.27, 6.0.28, 6.0.29, 6.0.30, 6.0.31, 6.0.32, 6.0.33, 6.0.35, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.0.21, 7.0.22, 7.0.23, 7.0.25, 7.0.28

Vendor Advisories

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Application Platform 520which fix multiple security issues are now available for Red HatEnterprise Linux 4, 5, and 6The Red Hat Security Response Team has rated this ...
Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic An update for JBoss Enterprise Application Platform 520 which fixesmultiple security issues is now available from the Red Hat Customer PortalThe Red Hat Security Response Team has rated this update as having moder ...
Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Web Platform 520 whichfix multiple security issues are now available for Red Hat Enterprise Linux4, 5, and 6The Red Hat Security Response Team has rated this update a ...
Synopsis Important: JBoss Enterprise SOA Platform 531 update Type/Severity Security Advisory: Important Topic JBoss Enterprise SOA Platform 531 roll up patch 1, which fixes multiplesecurity issues and various bugs, is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has r ...
Synopsis Important: tomcat6 security update Type/Severity Security Advisory: Important Topic Updated tomcat6 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerab ...
Synopsis Important: tomcat5 security update Type/Severity Security Advisory: Important Topic Updated tomcat5 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerab ...
Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Application Platform 601that fix multiple security issues are now available for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this updat ...
Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic An update for the Apache Tomcat 6 component for JBoss Enterprise Web Server200 that fixes multiple security issues is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has rated this u ...
Several security issues were fixed in Apache Tomcat ...
Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic Updated tomcat6 packages that fix multiple security issues are nowavailable for JBoss Enterprise Web Server 200 for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this update as having ...