CVE-2012-5886

MediumCVSS 5.0/10Last modified Oct 9, 2026

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 17, 2012
Last modified
Oct 9, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-58875.0The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does notCVE-2012-58884.3Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to injeCVE-2012-58894.3Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web sCVE-2012-58905.0The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwCVE-2012-58916.8Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to CVE-2012-58925.0Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackeCVE-2012-58936.8Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary codCVE-2012-58947.5SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands viaCVE-2012-589510.0Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.CVE-2012-589610.0The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the AdCVE-2012-58979.3The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properCVE-2012-58986.8Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administra
CVE-2012-5886: Medium severity, CVSS 5.0 | Vulnix