CVE-2012-5885: Medium severity tomcat vulnerability
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5885?
CVE-2012-5885 has a medium severity rating due to its potential to allow unauthorized access to protected resources.
How do I fix CVE-2012-5885?
To fix CVE-2012-5885, you need to upgrade to Apache Tomcat versions 5.5.36, 6.0.36, or 7.0.30 or later.
What versions of Apache Tomcat are affected by CVE-2012-5885?
CVE-2012-5885 affects Apache Tomcat versions 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30.
What type of vulnerability is CVE-2012-5885?
CVE-2012-5885 is an authentication vulnerability related to the HTTP Digest Access Authentication implementation.
Can CVE-2012-5885 be exploited remotely?
Yes, CVE-2012-5885 can be exploited remotely, allowing attackers to bypass authentication mechanisms under certain conditions.