CVE-2011-2204 – org.apache.tomcat:tomcat

Package

Manager: maven
Name: org.apache.tomcat:tomcat
Vulnerable Version: >=5.5.0 <5.5.34 || >=6.0.0 <6.0.33 || >=7.0.0 <7.0.19

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00074 pctl0.22958

Details

Insertion of Sensitive Information into Log File in Apache Tomcat Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.

Metadata

Created: 2022-05-14T01:17:03Z
Modified: 2024-02-21T21:32:35Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c57p-3v2g-w9rg/GHSA-c57p-3v2g-w9rg.json
CWE IDs: ["CWE-200", "CWE-532"]
Alternative ID: GHSA-c57p-3v2g-w9rg
Finding: F038
Auto approve: 1