Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

Remediation

References

CVE-2012-5887

Related Vulnerabilities

Jboss EAP Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Vulnerability (CVE-2018-1067)

WordPress Plugin Manage Calameo Publications by Athlon Cross-Site Scripting (1.1.0)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14330)

MySQL CVE-2024-20971 Vulnerability (CVE-2024-20971)

Liferay Portal Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2022-42129)

Severity

Medium

Classification

CVE-2012-5887 CWE-287

Tags

Missing Update Known Vulnerabilities