{"id":"CVE-2012-5887","url":"https://www.cyber-defence.io/tools/cve/CVE-2012-5887","generatedAt":"2026-11-05T08:05:28.612Z","title":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it…","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","published":"2012-11-17T19:55:03.000Z","lastModified":"2026-10-09T20:17:06.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N"},"cwe":["CWE-287"],"affected":["apache/tomcat"],"epss":{"score":0.12098,"percentile":0.96161,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 12.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0623.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0629.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0631.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0632.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0633.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0640.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0647.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0648.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0726.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/51371","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1377807","tags":["Permissions Required"],"source":"cve@mitre.org"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1380829","tags":["Permissions Required"],"source":"cve@mitre.org"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1392248","tags":["Permissions Required"],"source":"cve@mitre.org"},{"url":"http://tomcat.apache.org/security-5.html","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://tomcat.apache.org/security-6.html","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://tomcat.apache.org/security-7.html","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21626891","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/56403","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"http://www.ubuntu.com/usn/USN-1637-1","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79809","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0623.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0629.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0631.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0632.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0633.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0640.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0647.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0648.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0726.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/51371","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1377807","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1380829","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1392248","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://tomcat.apache.org/security-5.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://tomcat.apache.org/security-6.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://tomcat.apache.org/security-7.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21626891","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/56403","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-1637-1","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79809","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-5887","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}