Every CVE Search/ Get API key

CVE-2012-5886

Improper Authentication in Apache Tomcat

5.0 MediumFix available

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Exploit likelihood

8.77%Up 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Record
CVE-2012-5886
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Record
CVE-2012-5886
Updated
2026-11-02
EUVDEUVD-2022-3468 No score

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Record
EUVD-2022-3468
Updated
2026-11-02
GitHub AdvisoriesGHSA-9xrj-439h-62hg No score

Improper Authentication in Apache Tomcat

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Record
GHSA-9xrj-439h-62hg
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-9xrj-439h-62hg No score

Improper Authentication in Apache Tomcat

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Record
GHSA-9xrj-439h-62hg
Weakness
CWE-287
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-catalina
Maven
 5.5.0 up to 5.5.36
5.5.36
org.apache.tomcat:tomcat-catalina
Maven
 6.0.0 up to 6.0.36
6.0.36
org.apache.tomcat:tomcat-catalina
Maven
 7.0.0 up to 7.0.30
7.0.30
org.apache.tomcat:tomcat-catalina
Maven
 7.0.0 up to 7.0.30, plus listed versions
7.0.117.0.127.0.147.0.167.0.19
Show 14 moreShow less
7.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.47.0.57.0.67.0.8
7.0.30
tomcat6
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
Show 91 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::client
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::computenode
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-lib
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-javadoc
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
tomcat6-webapps
Red Hat:enterprise_linux:6::workstation
 before 0:6.0.24-52.el6_4
0:6.0.24-52.el6_4
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el4
 before 0:2.1.13-3_patch_02.ep5.el4
0:2.1.13-3_patch_02.ep5.el4
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-lib
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_web_platform:5::el5
 before 0:2.1.13-3_patch_02.ep5.el5
0:2.1.13-3_patch_02.ep5.el5
jbossweb
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-el-1.0-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-jsp-2.1-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-lib
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
jbossweb-servlet-2.5-api
Red Hat:jboss_enterprise_web_platform:5::el6
 before 0:2.1.13-4_patch_02.ep5.el6
0:2.1.13-4_patch_02.ep5.el6
tomcat5
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-admin-webapps
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-common-lib
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jasper
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jasper-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jsp-2.0-api
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-jsp-2.0-api-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-server-lib
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-servlet-2.4-api
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-servlet-2.4-api-javadoc
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
tomcat5-webapps
Red Hat:enterprise_linux:5::server
 before 0:5.5.23-0jpp.38.el5_9
0:5.5.23-0jpp.38.el5_9
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5886 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published November 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.77%, the 95th percentile. Fixed in org.apache.tomcat:tomcat-catalina 5.5.36.

References

Show 57 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open