Home

CVE-2012-5887

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Risk Information

Base Score
8.6
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
EPSS Score
Exploitation Probability
0.897

Associated Vulnerability

VulnerabilityOS Platform
Update Tomcat to 9.5.14Windows
Update Tomcat to 9.5.5Windows
Update Tomcat to 9.5.7Windows
Update Tomcat to 9.5.8Windows
Update Tomcat to 9.6.10Windows
Update Tomcat to 9.6.3Windows
Update Tomcat to 9.6.4Windows
Update Tomcat to 9.6.7Windows
Update Tomcat to 9.6.8Windows
Update Tomcat to 2.4.5Windows
Update Tomcat to 3.0.14Windows
Vulnerabilities CVE-2012-5887,CVE-2012-5885 are fixed in Apache - tomcat 5.5.36Windows
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-4431,CVE-2012-5885 are fixed in Apache - tomcat 6.0.36Windows
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-5885 are fixed in Apache - tomcat 7.0.30Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.3Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4Windows
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-5885,CVE-2012-3544 are fixed in Apache - tomcat 7.0.30Windows
Update Tomcat to 9.5.14 (For Linux)Linux
Update Tomcat to 9.5.5 (For Linux)Linux
Update Tomcat to 9.5.7 (For Linux)Linux
Update Tomcat to 9.5.8 (For Linux)Linux
Update Tomcat to 9.6.10 (For Linux)Linux
Update Tomcat to 9.6.3 (For Linux)Linux
Update Tomcat to 9.6.4 (For Linux)Linux
Update Tomcat to 9.6.7 (For Linux)Linux
Update Tomcat to 9.6.8 (For Linux)Linux
Update Tomcat to 2.4.5 (For Linux)Linux
Update Tomcat to 3.0.14 (For Linux)Linux
Vulnerabilities CVE-2012-5887,CVE-2012-5885 are fixed in Apache - tomcat for Linux 5.5.36Linux
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-4431,CVE-2012-5885 are fixed in Apache - tomcat for Linux 6.0.36Linux
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-5885 are fixed in Apache - tomcat for Linux 7.0.30Linux
Vulnerabilities CVE-2012-5887,CVE-2012-3546,CVE-2012-5885,CVE-2012-3544 are fixed in Apache - tomcat for Linux 7.0.30Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234