vulnerability
Apache Tomcat: Low: Timing Attack (CVE-2016-0762)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:P/I:N/A:N) | Oct 28, 2016 | Oct 28, 2016 | Aug 11, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Published
Oct 28, 2016
Added
Oct 28, 2016
Modified
Aug 11, 2025
Description
The Realm implementations did not process the supplied password if the
supplied user name did not exist. This made a timing attack possible to
determine valid user names. Note that the default configuration includes
the LockOutRealm which makes exploitation of this vulnerability
harder.
Solutions
apache-tomcat-upgrade-6_0_47apache-tomcat-upgrade-7_0_72apache-tomcat-upgrade-8_0_37
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.