CVE-2012-5887: Improper Authentication in Apache Tomcat

org.apache.tomcat:tomcat Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2012-5887

CVE

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

CVE-2012-5887: Improper Authentication in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.

>= 5.5.0, < 5.5.36 >= 6.0.0, < 6.0.36 >= 7.0.0, < 7.0.30

Fixed in 5.5.36, 6.0.36 or 7.0.30, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. The vulnerability identified as CVE-2012-5887 affects versions 5.5.x, 6.x, and 7.x of Apache Tomcat. This vulnerability is related to the HTTP Digest Access Authentication implementation in Tomcat. Digest Access Authentication is a method used for HTTP authentication that provides a more secure alternative to Basic Authentication. However, due to improper implementation, this vulnerability allows remote attackers to bypass access restrictions by sniffing the network for valid requests.

Vulnerability Detail

The vulnerability arises from the HTTP Digest Access Authentication implementation in Apache Tomcat. It fails to properly check for stale nonce values in conjunction with the enforcement of proper credentials. This oversight makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. By exploiting this vulnerability, an attacker can gain unauthorized access to restricted resources or perform unauthorized actions on the affected system. The impact of this vulnerability can vary depending on the specific configuration and usage of Apache Tomcat.

How To Fix

Latest published version: 11.0.27 as of 23 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 5.5.0, < 5.5.36 5.5.36
>= 6.0.0, < 6.0.36 6.0.36
>= 7.0.0, < 7.0.30 7.0.30

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of Apache Tomcat.

Conclusion

The vulnerability identified as CVE-2012-5887 in Apache Tomcat can allow remote attackers to bypass access restrictions and gain unauthorized access to restricted resources. It is crucial to upgrade to a fixed version of Apache Tomcat (5.5.36, 6.0.36, or 7.0.30) to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for org.apache.tomcat:tomcat →

FAQ

What is Apache Tomcat?

Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.

What is HTTP Digest Access Authentication?

HTTP Digest Access Authentication is a method used for HTTP authentication that provides a more secure alternative to Basic Authentication.

What is the impact of this vulnerability?

This vulnerability allows remote attackers to bypass access restrictions by sniffing the network for valid requests, potentially gaining unauthorized access to restricted resources or performing unauthorized actions on the affected system.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. The fix is included in versions 5.5.36, 6.0.36, and 7.0.30.