CVEvulnerability

CVE-2016-0762

5.9 MEDIUM Published 2017-08-10 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2017-08-10
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-203

Description

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Affected configurations

• apache tomcat (>= 6.0.0 <= 6.0.45) • apache tomcat (>= 7.0.0 <= 7.0.70) • apache tomcat (>= 8.0 <= 8.0.36) • apache tomcat (>= 8.5.0 <= 8.5.4) • apache tomcat 9.0.0 • canonical ubuntu linux 16.04 • debian debian linux 8.0 • redhat jboss enterprise web server 3.0.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.4 • redhat enterprise linux eus 7.5 • redhat enterprise linux eus 7.6 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server tus 7.6 • redhat enterprise linux server tus 7.7 • redhat enterprise linux workstation 7.0 • netapp oncommand insight • netapp oncommand shift • netapp snap creator framework • oracle communications diameter signaling router (>= 8.0.0 <= 8.5.0) • oracle tekelec platform distribution (>= 7.4.0 <= 7.7.1)

Related

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References