vulnerability
Apache Tomcat: Low: Timing Attack (CVE-2016-0762)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:P/I:N/A:N) | Oct 28, 2016 | Oct 28, 2016 | May 5, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Published
Oct 28, 2016
Added
Oct 28, 2016
Modified
May 5, 2025
Description
The Realm implementations did not process the supplied password if the
supplied user name did not exist. This made a timing attack possible to
determine valid user names. Note that the default configuration includes
the LockOutRealm which makes exploitation of this vulnerability
harder.
Solution(s)
apache-tomcat-upgrade-6_0_47apache-tomcat-upgrade-7_0_72apache-tomcat-upgrade-8_0_37
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.