CVE-2012-5886
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches i
CVSS
5.0
No CVSS
EPSS
8.8%
p95
KEV
—
Exploit Today
29
0-100
Published: Nov 17, 2012 · Last modified: Oct 9, 2026 · CWE-287
8.8%EPSS · 30 days8.8%
2026-10-012026-10-28
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0623.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0629.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0631.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0632.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0633.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0640.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0647.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0648.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0726.html
- secunia.comhttp://secunia.com/advisories/51371
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1377807
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1380829
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1392248
- tomcat.apache.orghttp://tomcat.apache.org/security-5.html
- tomcat.apache.orghttp://tomcat.apache.org/security-6.html
- tomcat.apache.orghttp://tomcat.apache.org/security-7.html
- www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21626891
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1070589.8 CRI—
———An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.10hCVE-2026-936809.8 CRI—
———IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.14hCVE-2026-908624.3 MED—
———Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.13hCVE-2026-842966.8 MED—
———Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.13hCVE-2026-8429510.0 CRI—
———Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.13hCVE-2026-1102457.5 HIG—
———IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.14h