Lucene search

MitreCVE-2012-5887

HistoryNov 17, 2012 - 7:55 p.m.

CVE-2012-5887

2012-11-1719:55:02

CWE-287

mitre

web.nvd.nist.gov

apache tomcat

http

digest

access authentication

implementation

vulnerability

cve-2012-5887

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.5

Confidence

High

EPSS

0.003

Percentile

71.6%

JSON

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Affected configurations

Nvd

Node

apachetomcatMatch5.5.0

apachetomcatMatch5.5.1

apachetomcatMatch5.5.2

apachetomcatMatch5.5.3

apachetomcatMatch5.5.4

apachetomcatMatch5.5.5

apachetomcatMatch5.5.6

apachetomcatMatch5.5.7

apachetomcatMatch5.5.8

apachetomcatMatch5.5.9

apachetomcatMatch5.5.10

apachetomcatMatch5.5.11

apachetomcatMatch5.5.12

apachetomcatMatch5.5.13

apachetomcatMatch5.5.14

apachetomcatMatch5.5.15

apachetomcatMatch5.5.16

apachetomcatMatch5.5.17

apachetomcatMatch5.5.18

apachetomcatMatch5.5.19

apachetomcatMatch5.5.20

apachetomcatMatch5.5.21

apachetomcatMatch5.5.22

apachetomcatMatch5.5.23

apachetomcatMatch5.5.24

apachetomcatMatch5.5.25

apachetomcatMatch5.5.26

apachetomcatMatch5.5.27

apachetomcatMatch5.5.28

apachetomcatMatch5.5.29

apachetomcatMatch5.5.30

apachetomcatMatch5.5.31

apachetomcatMatch5.5.32

apachetomcatMatch5.5.33

apachetomcatMatch5.5.34

apachetomcatMatch5.5.35

Node

apachetomcatMatch6.0

apachetomcatMatch6.0.0

apachetomcatMatch6.0.0alpha

apachetomcatMatch6.0.1

apachetomcatMatch6.0.1alpha

apachetomcatMatch6.0.2

apachetomcatMatch6.0.2alpha

apachetomcatMatch6.0.2beta

apachetomcatMatch6.0.3

apachetomcatMatch6.0.4

apachetomcatMatch6.0.4alpha

apachetomcatMatch6.0.5

apachetomcatMatch6.0.6

apachetomcatMatch6.0.6alpha

apachetomcatMatch6.0.7

apachetomcatMatch6.0.7alpha

apachetomcatMatch6.0.7beta

apachetomcatMatch6.0.8

apachetomcatMatch6.0.8alpha

apachetomcatMatch6.0.9

apachetomcatMatch6.0.9beta

apachetomcatMatch6.0.10

apachetomcatMatch6.0.11

apachetomcatMatch6.0.12

apachetomcatMatch6.0.13

apachetomcatMatch6.0.14

apachetomcatMatch6.0.15

apachetomcatMatch6.0.16

apachetomcatMatch6.0.17

apachetomcatMatch6.0.18

apachetomcatMatch6.0.19

apachetomcatMatch6.0.20

apachetomcatMatch6.0.24

apachetomcatMatch6.0.26

apachetomcatMatch6.0.27

apachetomcatMatch6.0.28

apachetomcatMatch6.0.29

apachetomcatMatch6.0.30

apachetomcatMatch6.0.31

apachetomcatMatch6.0.32

apachetomcatMatch6.0.33

apachetomcatMatch6.0.35

Node

apachetomcatMatch7.0.0

apachetomcatMatch7.0.0beta

apachetomcatMatch7.0.1

apachetomcatMatch7.0.2

apachetomcatMatch7.0.2beta

apachetomcatMatch7.0.3

apachetomcatMatch7.0.4

apachetomcatMatch7.0.4beta

apachetomcatMatch7.0.5

apachetomcatMatch7.0.6

apachetomcatMatch7.0.7

apachetomcatMatch7.0.8

apachetomcatMatch7.0.9

apachetomcatMatch7.0.10

apachetomcatMatch7.0.11

apachetomcatMatch7.0.12

apachetomcatMatch7.0.13

apachetomcatMatch7.0.14

apachetomcatMatch7.0.15

apachetomcatMatch7.0.16

apachetomcatMatch7.0.17

apachetomcatMatch7.0.18

apachetomcatMatch7.0.19

apachetomcatMatch7.0.20

apachetomcatMatch7.0.21

apachetomcatMatch7.0.22

apachetomcatMatch7.0.23

apachetomcatMatch7.0.25

apachetomcatMatch7.0.28

VendorProductVersionCPE
apachetomcat5.5.0cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
apachetomcat5.5.1cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
apachetomcat5.5.2cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
apachetomcat5.5.3cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
apachetomcat5.5.4cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
apachetomcat5.5.5cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
apachetomcat5.5.6cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
apachetomcat5.5.7cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
apachetomcat5.5.8cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
apachetomcat5.5.9cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tomcat	5.5.0	cpe:2.3:a:apache:tomcat:5.5.0:::::::*
apache	tomcat	5.5.1	cpe:2.3:a:apache:tomcat:5.5.1:::::::*
apache	tomcat	5.5.2	cpe:2.3:a:apache:tomcat:5.5.2:::::::*
apache	tomcat	5.5.3	cpe:2.3:a:apache:tomcat:5.5.3:::::::*
apache	tomcat	5.5.4	cpe:2.3:a:apache:tomcat:5.5.4:::::::*
apache	tomcat	5.5.5	cpe:2.3:a:apache:tomcat:5.5.5:::::::*
apache	tomcat	5.5.6	cpe:2.3:a:apache:tomcat:5.5.6:::::::*
apache	tomcat	5.5.7	cpe:2.3:a:apache:tomcat:5.5.7:::::::*
apache	tomcat	5.5.8	cpe:2.3:a:apache:tomcat:5.5.8:::::::*
apache	tomcat	5.5.9	cpe:2.3:a:apache:tomcat:5.5.9:::::::*