CVE-2012-5885: Improper Access Control in Apache Tomcat
Summary
CVE-2012-5885: Improper Access Control in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.36
>= 6.0.0, < 6.0.36
>= 7.0.0, < 7.0.30
Fixed in 5.5.36, 6.0.36 or 7.0.30, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy and run Java web applications. It provides a Java HTTP web server environment for running Java code. Apache Tomcat is widely used in enterprise environments and is known for its scalability and reliability. However, it is susceptible to security vulnerabilities, including the one described in this report.
Vulnerability Detail
The vulnerability identified as CVE-2012-5885 is an improper access control issue in Apache Tomcat. Specifically, the replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat versions 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (client nonce) values instead of nonce (server nonce) and nc (nonce-count) values. This flaw makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. It is important to note that this vulnerability is different from CVE-2011-1184.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.365.5.36 -
>= 6.0.0, < 6.0.366.0.36 -
>= 7.0.0, < 7.0.307.0.30
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a fixed version of Apache Tomcat.
Conclusion
In conclusion, the vulnerability identified as CVE-2012-5885 in Apache Tomcat poses a risk of improper access control. It is crucial for users to upgrade to the fixed versions of Apache Tomcat (5.5.36, 6.0.36, or 7.0.30) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy and run Java web applications.
The vulnerability allows remote attackers to bypass access restrictions by sniffing the network for valid requests, potentially leading to unauthorized access to sensitive information or system compromise.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of Apache Tomcat.
The vulnerability affects Apache Tomcat versions 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30.
There are no known public exploits for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
