{"id":"CVE-2012-5885","aliases":["EUVD-2022-3341","GHSA-99rf-92v6-cwx4","RHSA-2013:0266","RHSA-2013:0623","RHSA-2013:0629","RHSA-2013:0631","RHSA-2013:0640","RHSA-2013:0647"],"status":"published","title":"Improper Access Control in Apache Tomcat","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0898,"percentile":0.95295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-284"],"published":"2012-11-17T19:00:00Z","modified":"2026-10-09T20:17:05Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["5.5.36","6.0.36","7.0.30"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.36"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21626891","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=136612293908376\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://secunia.com/advisories/51371","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19432","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1392248","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0631.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0640.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1637-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/56403","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0648.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0633.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0629.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0647.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0632.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1380829","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0623.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80408","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1377807","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0726.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5885","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-99rf-92v6-cwx4"},{"url":"https://access.redhat.com/errata/RHSA-2013:0266","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883637","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0266.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-2733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2733","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4431","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.32","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4534","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5885","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5886","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5887","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5887","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0623","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883634","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0623.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3546","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0629","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0629.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0631","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0631.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0640","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0640.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0647","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0647.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-5885","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","status":"published","published":"2012-11-17T19:00:00Z","modified":"2026-10-09T19:09:14.77Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2022-3341","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","status":"published","published":"2012-11-17T19:00:00Z","modified":"2026-10-09T19:09:14Z","updated_at":"2026-11-02T17:27:24.157251Z"}],"ghsa":[{"id":"GHSA-99rf-92v6-cwx4","title":"Improper Access Control in Apache Tomcat","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","status":"published","published":"2022-05-17T00:57:35Z","modified":"2023-01-27T05:02:35Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2012-5885","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","status":"published","published":"2012-11-17T19:55:02.673Z","modified":"2026-10-09T20:17:05.17Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"GHSA-99rf-92v6-cwx4","title":"Improper Access Control in Apache Tomcat","description":"The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.","status":"published","published":"2022-05-17T00:57:35Z","modified":"2023-11-08T03:57:10.582612Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"RHSA-2013:0266","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T20:35:16Z","modified":"2026-08-05T10:02:02Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0623","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T20:35:24Z","modified":"2026-08-05T10:02:05Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0629","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:29Z","modified":"2026-08-05T10:02:05Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0631","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:33Z","modified":"2026-08-05T10:02:06Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0640","title":"Red Hat Security Advisory: tomcat5 security update","status":"published","published":"2024-09-15T20:35:45Z","modified":"2026-08-05T10:02:07Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0647","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:29Z","modified":"2026-08-05T10:02:09Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}