CVE-2012-5887

תיאור (מקור, אנגלית)

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

מדדים

EPSS — סבירות ניצול

12% (אחוזון 100) נכון ל-11/10/2026

CWE

CWE-287

מוצרים מושפעים

apache: tomcat

קישורים

• http://tomcat.apache.org/security-5.html Vendor Advisory
• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://tomcat.apache.org/security-5.html Vendor Advisory
• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0623.html Third Party Advisory