Orta CVSS 5.9

CVE-2016-0762: Tomcat: güvenlik açığı

Yayın: 10 Ağustos 2017 19:29 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %7,99 (yüzdelik 95)
CWE: CWE-203
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	6.0.0	6.0.45	—
apache-tomcat	7.0.0	7.0.70	—
apache-tomcat	8.0	8.0.36	—
apache-tomcat	8.5.0	8.5.4	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
canonical-ubuntu-linux	16.04	16.04	—
debian-debian-linux	8.0	8.0	—
redhat-jboss-enterprise-web-server	3.0.0	3.0.0	—
redhat-enterprise-linux-desktop	7.0	7.0	—
redhat-enterprise-linux-eus	7.4	7.4	—
redhat-enterprise-linux-eus	7.5	7.5	—
redhat-enterprise-linux-eus	7.6	7.6	—
redhat-enterprise-linux-eus	7.7	7.7	—
redhat-enterprise-linux-server	7.0	7.0	—
redhat-enterprise-linux-server-aus	7.4	7.4	—
redhat-enterprise-linux-server-aus	7.6	7.6	—
redhat-enterprise-linux-server-aus	7.7	7.7	—
redhat-enterprise-linux-server-tus	7.6	7.6	—
redhat-enterprise-linux-server-tus	7.7	7.7	—
redhat-enterprise-linux-workstation	7.0	7.0	—
netapp-oncommand-insight	—	—	—
netapp-oncommand-shift	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları