תיאור (מקור, אנגלית)
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
מוצרים מושפעים
apache: tomcat; canonical: ubuntu linux; debian: debian linux; redhat: jboss enterprise web server; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server tus; redhat: enterprise linux workstation; netapp: oncommand insight; netapp: oncommand shift; netapp: snap creator framework; oracle: communications diameter signaling router; oracle: tekelec platform distribution
קישורים10
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- rhn.redhat.com/errata/RHSA-2017-0457.html Third Party Advisory
- www.debian.org/security/2016/dsa-3720 Third Party Advisory
- www.securityfocus.com/bid/93939 Broken Link
- www.securitytracker.com/id/1037144 Broken Link
- access.redhat.com/errata/RHSA-2017:0455 Third Party Advisory
- access.redhat.com/errata/RHSA-2017:0456 Third Party Advisory
מדדים
- CVSS 3.1
-
5.9
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — סבירות ניצול
- 8% אחוזון 95 · נכון ל-10 בנובמבר 2026
- CWE
- CWE-203
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.