CVE-2012-5886: Improper Authentication in Apache Tomcat
Summary
CVE-2012-5886: Improper Authentication in Apache Tomcat. Affects org.apache.tomcat:tomcat-catalina across 3 version ranges.
>= 5.5.0, < 5.5.36
>= 6.0.0, < 6.0.36
>= 7.0.0, < 7.0.30
Fixed in 5.5.36, 6.0.36 or 7.0.30, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to serve Java applications. It provides a Java HTTP web server environment for running Java code. The vulnerability in Apache Tomcat allows remote attackers to bypass authentication by exploiting the caching of information about the authenticated user within the session state. This vulnerability affects versions 5.5.x, 6.x, and 7.x of Apache Tomcat.
Vulnerability Detail
The HTTP Digest Access Authentication implementation in Apache Tomcat caches information about the authenticated user within the session state. This caching makes it easier for remote attackers to bypass authentication by exploiting vectors related to the session ID. By manipulating the session ID, an attacker can gain unauthorized access to protected resources. This vulnerability has a moderate severity rating and is classified under CWE-287.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.365.5.36 -
>= 6.0.0, < 6.0.366.0.36 -
>= 7.0.0, < 7.0.307.0.30
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache Tomcat allows remote attackers to bypass authentication and gain unauthorized access to protected resources. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Tomcat. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat-catalina →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to serve Java applications.
This vulnerability allows remote attackers to bypass authentication and gain unauthorized access to protected resources.
Versions 5.5.x, 6.x, and 7.x of Apache Tomcat are affected.
To fix this vulnerability, upgrade to the fixed versions of Apache Tomcat: 5.5.36, 6.0.36, or 7.0.30.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat-catalina.
