PT-2012-6168 · Apache+3 · Apache Tomcat+3
Publicado
2012-11-17
·
Atualizado
2025-10-30
·
CVE-2012-5887
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 5.5.x through 5.5.35
Apache Tomcat versions 6.x through 6.0.35
Apache Tomcat versions 7.x through 7.0.29
Description
The issue is related to the HTTP Digest Access Authentication implementation, which does not properly check for stale nonce values when enforcing proper credentials. This makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Recommendations
For Apache Tomcat versions 5.5.x through 5.5.35, update to version 5.5.36 or later.
For Apache Tomcat versions 6.x through 6.0.35, update to version 6.0.36 or later.
For Apache Tomcat versions 7.x through 7.0.29, update to version 7.0.30 or later.
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Tomcat
Centos
Red Hat
Suse