CVE-2012-5887 in Tomcat
Summary
by MITRE
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2025
The vulnerability described in CVE-2012-5887 represents a critical weakness in the HTTP Digest Access Authentication mechanism implemented within Apache Tomcat web server versions. This flaw specifically affects versions prior to 5.5.36, 6.0.36, and 7.0.30 across their respective major versions, creating a security gap that allows unauthorized access to protected resources. The vulnerability stems from improper handling of nonce values during the authentication process, which are cryptographic tokens used to prevent replay attacks and ensure the freshness of authentication credentials. The weakness manifests when the system fails to properly validate whether nonce values have expired or become stale, enabling attackers to reuse valid authentication tokens that should have been invalidated after a certain period.
The technical implementation flaw resides in the authentication subsystem where Tomcat's digest authentication does not adequately enforce nonce freshness checks. According to CWE-310, this vulnerability relates to cryptographic issues involving the improper implementation of cryptographic protocols and the failure to properly validate cryptographic tokens. When an attacker captures valid authentication requests through network sniffing, they can exploit this weakness to reuse the captured credentials without proper re-authentication. The system's failure to properly enforce nonce expiration creates a window of opportunity for attackers to bypass intended access controls, essentially allowing them to impersonate legitimate users within the authenticated session period.
The operational impact of this vulnerability extends beyond simple credential theft, as it fundamentally undermines the security model of HTTP Digest Authentication. Attackers can leverage this weakness to gain unauthorized access to web applications protected by digest authentication, potentially leading to data breaches, privilege escalation, and system compromise. The vulnerability aligns with ATT&CK technique T1110.003, which covers credential access through the exploitation of weak or improperly implemented authentication mechanisms. Organizations running affected Tomcat versions face significant risk as the attack vector requires minimal technical expertise and can be executed through passive network monitoring, making it particularly dangerous in environments where network traffic is not properly secured or encrypted.
Mitigation strategies for this vulnerability require immediate patching of affected Tomcat installations to versions 5.5.36, 6.0.36, and 7.0.30 or later, which contain the necessary fixes for proper nonce validation. System administrators should also implement network segmentation and encryption to prevent passive credential capture, as well as consider migrating from HTTP Digest Authentication to more robust authentication methods such as HTTPS with certificate-based authentication or OAuth. Additional defensive measures include monitoring for suspicious authentication patterns and implementing stronger session management policies. Organizations should also review their authentication configurations to ensure proper enforcement of credential freshness and nonce validation, as this vulnerability demonstrates the critical importance of proper cryptographic implementation in web server security. The fix addresses the underlying cryptographic weakness by ensuring that stale nonce values are properly rejected during the authentication process, thereby maintaining the integrity of the authentication mechanism and preventing unauthorized access to protected resources.