GitHub Advisoryadvisory · Maven

GHSA-jgm2-m5cg-f66g Authentication Bypass in Apache Tomcat

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-3546
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.36 → fixed in 6.0.36 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.30 → fixed in 7.0.30

Description

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.

Related

Alias · CVE (1)

  • CVE-2012-3546 org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References