CVE-2012-5886CWE-287

CVE-2012-5886

Medium · published November 18, 2012

CVSS v2.0
5.0
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

The record
Technical detail
CVSS v2.0
5.0 · MEDIUM
Vector
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS v4.0
Not supplied
EPSS
0.08768 · 95.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2012-11-18T00:55Z
Affected products (107)
ProductVersionsFixed in
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
References (46)
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html · [email protected]http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html · [email protected]http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0623.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0629.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0631.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0632.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0633.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0640.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0647.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0648.html · [email protected]http://rhn.redhat.com/errata/RHSA-2013-0726.html · [email protected]http://secunia.com/advisories/51371 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1377807 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1380829 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1392248 · [email protected]http://tomcat.apache.org/security-5.html · [email protected]http://tomcat.apache.org/security-6.html · [email protected]http://tomcat.apache.org/security-7.html · [email protected]http://www-01.ibm.com/support/docview.wss?uid=swg21626891 · [email protected]http://www.securityfocus.com/bid/56403 · [email protected]http://www.ubuntu.com/usn/USN-1637-1 · [email protected]https://exchange.xforce.ibmcloud.com/vulnerabilities/80407 · [email protected]http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0623.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0629.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0631.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0632.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0633.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0640.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0647.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0648.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0726.html · af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51371 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1377807 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1380829 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1392248 · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-5.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-6.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-7.html · af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21626891 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/56403 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1637-1 · af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/80407 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 NOV 19:00Z
    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about…
    cvelistv5