{"id":"CVE-2012-5887","aliases":["EUVD-2022-1939","GHSA-28cq-6rmx-pjq4","RHSA-2013:0266","RHSA-2013:0623","RHSA-2013:0629","RHSA-2013:0631","RHSA-2013:0640","RHSA-2013:0647"],"status":"published","title":"Improper Authentication in Apache Tomcat","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12098,"percentile":0.96175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2012-11-17T19:00:00Z","modified":"2026-10-09T20:17:05Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["5.5.36","6.0.36","7.0.30"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.36"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-52.el6_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el5","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-3_patch_02.ep5.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_platform:5::el6","package":"jbossweb-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-4_patch_02.ep5.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.38.el5_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21626891","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/51371","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1392248","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0631.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0640.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-1637-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/bid/56403","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0648.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0633.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0629.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79809","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0647.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0632.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1380829","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0623.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1377807","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0726.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5887","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-28cq-6rmx-pjq4"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0266","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883637","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0266.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-2733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2733","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4431","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.32","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4534","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5885","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5886","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5887","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0623","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883634","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0623.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3546","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0629","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0629.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0631","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0631.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0640","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0640.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0647","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0647.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-5887","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","status":"published","published":"2012-11-17T19:00:00Z","modified":"2026-10-09T19:10:16.077Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2022-1939","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","status":"published","published":"2012-11-17T19:00:00Z","modified":"2026-10-09T19:10:16Z","updated_at":"2026-11-02T17:27:24.157251Z"}],"ghsa":[{"id":"GHSA-28cq-6rmx-pjq4","title":"Improper Authentication in Apache Tomcat","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","status":"published","published":"2022-05-17T01:38:30Z","modified":"2023-01-27T05:02:30Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2012-5887","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","status":"published","published":"2012-11-17T19:55:02.813Z","modified":"2026-10-09T20:17:05.797Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"GHSA-28cq-6rmx-pjq4","title":"Improper Authentication in Apache Tomcat","description":"The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.","status":"published","published":"2022-05-17T01:38:30Z","modified":"2023-11-08T03:57:10.706221Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RHSA-2013:0266","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T20:35:16Z","modified":"2026-08-05T10:02:02Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0623","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T20:35:24Z","modified":"2026-08-05T10:02:05Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0629","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:29Z","modified":"2026-08-05T10:02:05Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0631","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:33Z","modified":"2026-08-05T10:02:06Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0640","title":"Red Hat Security Advisory: tomcat5 security update","status":"published","published":"2024-09-15T20:35:45Z","modified":"2026-08-05T10:02:07Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0647","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:29Z","modified":"2026-08-05T10:02:09Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}