CVE-2012-5886: Medium severity Apache Tomcat vulnerability
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 7.0.30 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 6.0.36 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcat-catalinato a version that resolves this vulnerability.Fixed in 5.5.36
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5886?
CVE-2012-5886 is classified as a medium-severity vulnerability.
How do I fix CVE-2012-5886?
To fix CVE-2012-5886, upgrade Apache Tomcat to versions 5.5.36, 6.0.36, or 7.0.30 or later.
What types of Apache Tomcat versions are affected by CVE-2012-5886?
CVE-2012-5886 affects Apache Tomcat versions before 5.5.36, 6.0.36, and 7.0.30.
Can exploitation of CVE-2012-5886 lead to unauthorized access?
Yes, exploitation of CVE-2012-5886 can allow unauthorized users to bypass authentication.
What browsers or clients are impacted by CVE-2012-5886?
CVE-2012-5886 impacts any client that uses HTTP Digest Access Authentication with vulnerable versions of Tomcat.