VULNERABILITY INTELLIGENCE
CVE-2011-5062
CVSS score5 MEDIUM
EPSS probability7.36%
CISA KEVNot currently listed
Published2012-01-14
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Description
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.