CVEvulnerability

CVE-2012-5887

5.0 MEDIUM Published 2012-11-17 Modified 2026-10-09 Official page ↗
Status
Analyzed
Published
2012-11-17
Last modified
2026-10-09
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-287

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Affected configurations

• apache tomcat (>= 5.5.0 < 5.5.36) • apache tomcat (>= 6.0.0 < 6.0.36) • apache tomcat (>= 7.0.0 < 7.0.30)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References