-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 5.5.0, < 5.5.36 | 5.5.36 |
| org.apache.tomcat:tomcat | maven | >= 6.0.0, < 6.0.36 | 6.0.36 |
| org.apache.tomcat:tomcat | maven | >= 7.0.0, < 7.0.30 | 7.0.30 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper nonce handling in Tomcat's DigestAuthenticator. The commit diffs (r1377807/r1380829/r1392248) show fixes to track server-generated nonces, add nonce count validation, and improve stale nonce checks. The authenticate() method would have processed client-provided nonces without proper server-side validation, while validateNonce() lacked adequate staleness checks. These functions are directly referenced in security advisories and patch documentation related to CVE-2012-5887.
Ongoing coverage of React2Shell