CVE-2012-5887

⚪ Do wiadomości

Błąd w uwierzytelnianiu w Apache Tomcat umożliwia zdalne ominięcie ograniczeń dostępu.

CVSS

5.0

EPSS

12.1%

Exploit

none

Vendor

apache

Opis źródłowy (NVD)

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

brak Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	5.0
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	12.1%
Opublikowano (NVD)	2012-11-17 19:55:02 UTC
Ostatnia modyfikacja (NVD)	2026-10-09 20:17:05 UTC

Referencje

http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html ([email protected]) [Third Party Advisory]
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html ([email protected]) [Third Party Advisory]
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0623.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0629.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0631.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0632.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0633.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0640.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0647.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0648.html ([email protected]) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2013-0726.html ([email protected]) [Third Party Advisory]
http://secunia.com/advisories/51371 ([email protected]) [Broken Link]
http://svn.apache.org/viewvc?view=revision&revision=1377807 ([email protected]) [Permissions Required]
http://svn.apache.org/viewvc?view=revision&revision=1380829 ([email protected]) [Permissions Required]
http://svn.apache.org/viewvc?view=revision&revision=1392248 ([email protected]) [Permissions Required]
http://tomcat.apache.org/security-5.html ([email protected]) [Vendor Advisory]
http://tomcat.apache.org/security-6.html ([email protected]) [Vendor Advisory]
http://tomcat.apache.org/security-7.html ([email protected]) [Vendor Advisory]
http://www-01.ibm.com/support/docview.wss?uid=swg21626891 ([email protected]) [Third Party Advisory]
http://www.securityfocus.com/bid/56403 ([email protected]) [Broken Link]
http://www.ubuntu.com/usn/USN-1637-1 ([email protected]) [Third Party Advisory]
https://exchange.xforce.ibmcloud.com/vulnerabilities/79809 ([email protected]) [Third Party Advisory, VDB Entry]