Lucene search

[email protected]NVD:CVE-2012-5886

HistoryNov 17, 2012 - 7:55 p.m.

CVE-2012-5886

2012-11-1719:55:02

CWE-287

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

9.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.7%

JSON

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Affected configurations

NVD

Node

apachetomcatMatch5.5.0

apachetomcatMatch5.5.1

apachetomcatMatch5.5.2

apachetomcatMatch5.5.3

apachetomcatMatch5.5.4

apachetomcatMatch5.5.5

apachetomcatMatch5.5.6

apachetomcatMatch5.5.7

apachetomcatMatch5.5.8

apachetomcatMatch5.5.9

apachetomcatMatch5.5.10

apachetomcatMatch5.5.11

apachetomcatMatch5.5.12

apachetomcatMatch5.5.13

apachetomcatMatch5.5.14

apachetomcatMatch5.5.15

apachetomcatMatch5.5.16

apachetomcatMatch5.5.17

apachetomcatMatch5.5.18

apachetomcatMatch5.5.19

apachetomcatMatch5.5.20

apachetomcatMatch5.5.21

apachetomcatMatch5.5.22

apachetomcatMatch5.5.23

apachetomcatMatch5.5.24

apachetomcatMatch5.5.25

apachetomcatMatch5.5.26

apachetomcatMatch5.5.27

apachetomcatMatch5.5.28

apachetomcatMatch5.5.29

apachetomcatMatch5.5.30

apachetomcatMatch5.5.31

apachetomcatMatch5.5.32

apachetomcatMatch5.5.33

apachetomcatMatch5.5.34

apachetomcatMatch5.5.35

Node

apachetomcatMatch6.0

apachetomcatMatch6.0.0

apachetomcatMatch6.0.0alpha

apachetomcatMatch6.0.1

apachetomcatMatch6.0.1alpha

apachetomcatMatch6.0.2

apachetomcatMatch6.0.2alpha

apachetomcatMatch6.0.2beta

apachetomcatMatch6.0.3

apachetomcatMatch6.0.4

apachetomcatMatch6.0.4alpha

apachetomcatMatch6.0.5

apachetomcatMatch6.0.6

apachetomcatMatch6.0.6alpha

apachetomcatMatch6.0.7

apachetomcatMatch6.0.7alpha

apachetomcatMatch6.0.7beta

apachetomcatMatch6.0.8

apachetomcatMatch6.0.8alpha

apachetomcatMatch6.0.9

apachetomcatMatch6.0.9beta

apachetomcatMatch6.0.10

apachetomcatMatch6.0.11

apachetomcatMatch6.0.12

apachetomcatMatch6.0.13

apachetomcatMatch6.0.14

apachetomcatMatch6.0.15

apachetomcatMatch6.0.16

apachetomcatMatch6.0.17

apachetomcatMatch6.0.18

apachetomcatMatch6.0.19

apachetomcatMatch6.0.20

apachetomcatMatch6.0.24

apachetomcatMatch6.0.26

apachetomcatMatch6.0.27

apachetomcatMatch6.0.28

apachetomcatMatch6.0.29

apachetomcatMatch6.0.30

apachetomcatMatch6.0.31

apachetomcatMatch6.0.32

apachetomcatMatch6.0.33

apachetomcatMatch6.0.35

Node

apachetomcatMatch7.0.0

apachetomcatMatch7.0.0beta

apachetomcatMatch7.0.1

apachetomcatMatch7.0.2

apachetomcatMatch7.0.2beta

apachetomcatMatch7.0.3

apachetomcatMatch7.0.4

apachetomcatMatch7.0.4beta

apachetomcatMatch7.0.5

apachetomcatMatch7.0.6

apachetomcatMatch7.0.7

apachetomcatMatch7.0.8

apachetomcatMatch7.0.9

apachetomcatMatch7.0.10

apachetomcatMatch7.0.11

apachetomcatMatch7.0.12

apachetomcatMatch7.0.13

apachetomcatMatch7.0.14

apachetomcatMatch7.0.15

apachetomcatMatch7.0.16

apachetomcatMatch7.0.17

apachetomcatMatch7.0.18

apachetomcatMatch7.0.19

apachetomcatMatch7.0.20

apachetomcatMatch7.0.21

apachetomcatMatch7.0.22

apachetomcatMatch7.0.23

apachetomcatMatch7.0.25

apachetomcatMatch7.0.28

References

lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

rhn.redhat.com/errata/RHSA-2013-0623.html

rhn.redhat.com/errata/RHSA-2013-0629.html

rhn.redhat.com/errata/RHSA-2013-0631.html

rhn.redhat.com/errata/RHSA-2013-0632.html

rhn.redhat.com/errata/RHSA-2013-0633.html

rhn.redhat.com/errata/RHSA-2013-0640.html

rhn.redhat.com/errata/RHSA-2013-0647.html

rhn.redhat.com/errata/RHSA-2013-0648.html

rhn.redhat.com/errata/RHSA-2013-0726.html

secunia.com/advisories/51371

svn.apache.org/viewvc?view=revision&revision=1377807

svn.apache.org/viewvc?view=revision&revision=1380829

svn.apache.org/viewvc?view=revision&revision=1392248

tomcat.apache.org/security-5.html

tomcat.apache.org/security-6.html

tomcat.apache.org/security-7.html

www-01.ibm.com/support/docview.wss?uid=swg21626891

www.securityfocus.com/bid/56403

www.ubuntu.com/usn/USN-1637-1

exchange.xforce.ibmcloud.com/vulnerabilities/80407

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

9.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.7%

JSON

Related for NVD:CVE-2012-5886

github1 cvelist1 cve2 osv2 debiancve1 prion1 redhat11 nessus29 openvas18 ubuntucve1 ibm3 nvd1 securityvulns2 ubuntu1 centos2 f51 oraclelinux2 debian1 vmware2 gentoo1