PT-2012-2041 · Apache+3 · Apache Tomcat+3
Publicado
2011-12-05
·
Atualizado
2022-05-14
·
CVE-2011-5063
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 5.5.x through 5.5.33
Apache Tomcat versions 6.x through 6.0.32
Apache Tomcat versions 7.x through 7.0.11
Description
The issue is related to the HTTP Digest Access Authentication implementation, which does not check realm values. This could allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements.
Recommendations
For Apache Tomcat versions 5.5.x through 5.5.33, update to version 5.5.34 or later.
For Apache Tomcat versions 6.x through 6.0.32, update to version 6.0.33 or later.
For Apache Tomcat versions 7.x through 7.0.11, update to version 7.0.12 or later.
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Tomcat
Centos
Red Hat
Suse