Every CVE Search/ Get API key

CVE-2012-5885

Improper Access Control in Apache Tomcat

5.0 MediumFix available

CVE-2012-5885 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published November 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.98%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 5.5.36.

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Exploit likelihood

8.98%Up 1.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Record
CVE-2012-5885
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Record
CVE-2012-5885
Updated
2026-11-02
EUVDEUVD-2022-3341 No score

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Record
EUVD-2022-3341
Updated
2026-11-02
GitHub AdvisoriesGHSA-99rf-92v6-cwx4 No score

Improper Access Control in Apache Tomcat

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Record
GHSA-99rf-92v6-cwx4
Weakness
CWE-284
Updated
2026-11-02
OSVGHSA-99rf-92v6-cwx4 No score

Improper Access Control in Apache Tomcat

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Record
GHSA-99rf-92v6-cwx4
Weakness
CWE-284
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 5.5.0 up to 5.5.36
5.5.36
org.apache.tomcat:tomcat
Maven
 6.0.0 up to 6.0.36
6.0.36
org.apache.tomcat:tomcat
Maven
 7.0.0 up to 7.0.30
7.0.30
tomcat6
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
Show 90 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-lib
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-lib
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
tomcat5
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-admin-webapps
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-common-lib
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jasper
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jasper-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jsp-2.0-api
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jsp-2.0-api-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-server-lib
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-servlet-2.4-api
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-servlet-2.4-api-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-webapps
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 60 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open