GitHub Advisoryadvisory · Maven

GHSA-36qh-35cm-5w2w Authentication Bypass by Alternate Name in Apache Tomcat

MEDIUM Published 2021-08-13 Modified 2022-02-08 Official page ↗
Aliases
CVE-2021-30640
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-116, CWE-287, CWE-289
Reviewed
2021-07-13

Affected packages

• Maven org.apache.tomcat:tomcat: >= 10.0.0-M1, < 10.0.5 → fixed in 10.0.5 • Maven org.apache.tomcat:tomcat: >= 9.0.0M1, < 9.0.45 → fixed in 9.0.45 • Maven org.apache.tomcat:tomcat: >= 8.5.0, < 8.5.65 → fixed in 8.5.65

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Related

Alias · CVE (1)

  • CVE-2021-30640 A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to… vulnerability

Weakness · CWE (3)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-287 Improper Authentication weakness
  • CWE-289 Authentication Bypass by Alternate Name weakness

References