A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-3-0-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-3-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-1-apiamazon-linux-ami-2-upgrade-tomcat-webapps | Sep 28, 2023 | Jul 12, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-tomcat7 | Sep 9, 2021 | Jul 12, 2021 |
| Apache Tomcat | apache-tomcat-upgrade-7_0_109apache-tomcat-upgrade-8_5_66apache-tomcat-upgrade-9_0_46apache-tomcat-upgrade-10_0_6apache-tomcat-10_0apache-tomcat-7_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Jul 13, 2021 | Jul 12, 2021 | |
| Debian | debian-upgrade-tomcat9 | Aug 9, 2021 | Jul 12, 2021 | |
| Freebsd | freebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat85freebsd-upgrade-package-tomcat9freebsd-upgrade-package-tomcat10 | Nov 4, 2022 | Aug 1, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-tomcat | Aug 22, 2022 | Jul 12, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-tomcathuawei-euleros-2_0_sp3-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp3-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-libhuawei-euleros-2_0_sp3-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp3-upgrade-tomcat-webapps | Oct 26, 2021 | Jul 12, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-tomcathuawei-euleros-2_0_sp5-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp5-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-libhuawei-euleros-2_0_sp5-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp5-upgrade-tomcat-webapps | Sep 29, 2021 | Jul 12, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Sep 24, 2021 | Jul 12, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-69-11-4-39-0-1-107-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-69-11-4-39-0-1-107-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-69-11-4-39-0-1-107-0 | Nov 17, 2021 | Jul 12, 2021 | |
| Suse | — | suse-upgrade-javapackages-toolssuse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Nov 4, 2021 | Jul 12, 2021 |
| Ubuntu | ubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Apr 1, 2022 | Jul 12, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub