Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LApache Tomcat
APPApache< 9.0.10110.1.0 – 10.1.37 (bez)11.0.0 – 11.0.5 (bez)
Related vulnerabilities
Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To...
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5....
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM bas...
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty...