#VU64540 Improper Authentication in Apache Tomcat - CVE-2012-5887

Cybersecurity Help s.r.o.

Published: 2022-06-21

Vulnerability identifier: #VU64540

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-5887

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache Tomcat
Server applications / Web servers

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to HTTP Digest Access Authentication implementation in Apache Tomcat does not properly check for stale nonce values in conjunction with enforcement of proper credentials. A remote attacker can bypass intended access restrictions by sniffing the network for valid requests.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache Tomcat: 5.5, 6.0.0 - 6.0.35, 7.0.0 - 7.0.29

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

Multiple vulnerabilities in Apache Tomcat