GitHub Advisoryadvisory · Maven

GHSA-4f7h-9j2x-cmr4 Improper Authentication in Apache Tomcat

MEDIUM Published 2022-05-14 Modified 2024-02-21 Official page ↗
Aliases
CVE-2011-5062
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.apache.tomcat:tomcat: >= 5.5.0, < 5.5.34 → fixed in 5.5.34 • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.33 → fixed in 6.0.33 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.12 → fixed in 7.0.12

Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

Related

Alias · CVE (1)

  • CVE-2011-5062 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References