Orta CVSS 6.5
CVE-2021-30640: Tomcat: güvenlik açığı
Açıklama (NVD)
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
Özet bilgiler
- Ürün
- Apache Tomcat
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - EPSS
- %9,89 (yüzdelik 96)
- CWE
- CWE-116
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-tomcat | 7.0.0 | — | 7.0.109 |
| apache-tomcat | 8.5.0 | — | 8.5.66 |
| apache-tomcat | 9.0.0 | — | 9.0.46 |
| apache-tomcat | 10.0.0 | — | 10.0.6 |
| oracle-communications-cloud-native-core-policy | 1.14.0 | 1.14.0 | — |
| oracle-communications-diameter-signaling-router | 8.0.0 | 8.5.0 | — |
| oracle-communications-pricing-design-center | 12.0.0.3.0 | 12.0.0.3.0 | — |
| oracle-hospitality-cruise-shipboard-property-management-system | 20.1.0 | 20.1.0 | — |
| oracle-tekelec-platform-distribution | 7.4.0 | 7.7.1 | — |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |