The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.12098.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

OR cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
JBEWP 5 for RHEL 5
jbossweb-0:2.1.13-3_patch_02.ep5.el5 cpe:/a:redhat:jboss_enterprise_web_platform:5::el5 RHSA-2013:0631 2013-03-11T00:00:00Z
JBEWP 5 for RHEL 6
jbossweb-0:2.1.13-4_patch_02.ep5.el6 cpe:/a:redhat:jboss_enterprise_web_platform:5::el6 RHSA-2013:0631 2013-03-11T00:00:00Z
JBoss Data Grid 6.1
cpe:/a:redhat:jboss_data_grid:6.1.0 RHSA-2013:0665 2013-03-20T00:00:00Z
JBoss Enterprise BRMS Platform 5.3
cpe:/a:redhat:jboss_enterprise_brms_platform:5.3 RHSA-2013:1006 2013-07-01T00:00:00Z
Red Hat Enterprise Linux 5
tomcat5-0:5.5.23-0jpp.38.el5_9 cpe:/o:redhat:enterprise_linux:5 RHSA-2013:0640 2013-03-12T00:00:00Z
Red Hat Enterprise Linux 6
tomcat6-0:6.0.24-52.el6_4 cpe:/o:redhat:enterprise_linux:6 RHSA-2013:0623 2013-03-11T00:00:00Z
Red Hat JBoss Enterprise Application Platform 5.2
cpe:/a:redhat:jboss_enterprise_application_platform:5.2.0 RHSA-2013:0632 2013-03-11T00:00:00Z
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4
jbossweb-0:2.1.13-3_patch_02.ep5.el4 cpe:/a:redhat:jboss_enterprise_application_platform:5::el4 RHSA-2013:0629 2013-03-11T00:00:00Z
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5
jbossweb-0:2.1.13-3_patch_02.ep5.el5 cpe:/a:redhat:jboss_enterprise_application_platform:5::el5 RHSA-2013:0629 2013-03-11T00:00:00Z
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6
jbossweb-0:2.1.13-4_patch_02.ep5.el6 cpe:/a:redhat:jboss_enterprise_application_platform:5::el6 RHSA-2013:0629 2013-03-11T00:00:00Z
Red Hat JBoss Enterprise Application Platform 6.0
cpe:/a:redhat:jboss_enterprise_application_platform:6.0.1 RHSA-2013:0648 2013-03-14T00:00:00Z
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
jbossweb-0:7.0.17-4.Final_redhat_3.ep6.el5 cpe:/a:redhat:jboss_enterprise_application_platform:6::el5 RHSA-2013:0647 2013-03-14T00:00:00Z
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6
jbossweb-0:7.0.17-4.Final_redhat_3.ep6.el6 cpe:/a:redhat:jboss_enterprise_application_platform:6::el6 RHSA-2013:0647 2013-03-14T00:00:00Z
Red Hat JBoss Enterprise Web Server 2 for RHEL 5
tomcat6-0:6.0.35-6_patch_06.ep6.el5 cpe:/a:redhat:jboss_enterprise_web_server:2::el5 RHSA-2013:0266 2013-02-19T00:00:00Z
Red Hat JBoss Enterprise Web Server 2 for RHEL 6
tomcat6-0:6.0.35-29_patch_06.ep6.el6 cpe:/a:redhat:jboss_enterprise_web_server:2::el6 RHSA-2013:0266 2013-02-19T00:00:00Z
Red Hat JBoss SOA Platform 5.3
cpe:/a:redhat:jboss_enterprise_soa_platform:5.3 RHSA-2013:0726 2013-04-09T00:00:00Z
Red Hat JBoss Web Platform 5.2
cpe:/a:redhat:jboss_enterprise_web_platform:5.2.0 RHSA-2013:0633 2013-03-11T00:00:00Z
Red Hat JBoss Web Server 2.0
cpe:/a:redhat:jboss_enterprise_web_server:2.0 RHSA-2013:0265 2013-02-19T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Apache Subscribe
Tomcat Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Jboss Data Grid Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Brms Platform Subscribe
Jboss Enterprise Soa Platform Subscribe
Jboss Enterprise Web Platform Subscribe
Jboss Enterprise Web Server Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-2725-1 tomcat6 security update
EUVD EUVD EUVD-2022-1939 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Github GHSA Github GHSA GHSA-28cq-6rmx-pjq4 Improper Authentication in Apache Tomcat
Ubuntu USN Ubuntu USN USN-1637-1 Tomcat vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0623.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0629.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0631.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0632.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0633.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0640.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0647.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0648.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0726.html cve-icon cve-icon
http://secunia.com/advisories/51371 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1377807 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1380829 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1392248 cve-icon cve-icon
http://tomcat.apache.org/security-5.html cve-icon cve-icon
http://tomcat.apache.org/security-6.html cve-icon cve-icon
http://tomcat.apache.org/security-7.html cve-icon cve-icon
http://www-01.ibm.com/support/docview.wss?uid=swg21626891 cve-icon cve-icon
http://www.securityfocus.com/bid/56403 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-1637-1 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/79809 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2012-5887 cve-icon
https://www.cve.org/CVERecord?id=CVE-2012-5887 cve-icon
History

Sat, 10 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Oct 2025 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*		 cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-09T19:10:16.077Z

Reserved: 2012-11-17T00:00:00.000Z

Link: CVE-2012-5887

cve-icon Vulnrichment

Updated: 2024-08-06T21:21:27.681Z

cve-icon NVD

Status : Analyzed

Published: 2012-11-17T19:55:02.813

Modified: 2026-10-09T20:17:05.797

Link: CVE-2012-5887

cve-icon Redhat

Severity : Moderate

Publid Date: 2012-11-05T00:00:00Z

Links: CVE-2012-5887 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses