Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration
| Reporter | Title | Published | Views | Family All 159 |
|---|---|---|---|---|
 | Security Bulletin: TADDM affected by multiple vulnerabilities due to Apache Tomcat libraries | 26 Mar 202503:33 | – | ibm |
 | Mac OS X < 10.6.3 Multiple Vulnerabilities | 30 Mar 201000:00 | – | nessus |
| CentOS 5 : tomcat (CESA-2009:1164) | 6 Jan 201000:00 | – | nessus |
| Debian DSA-2207-1 : tomcat5.5 - several vulnerabilities | 30 Mar 201100:00 | – | nessus |
| Fedora 12 : tomcat6-6.0.20-1.fc12 (2009-11352) | 30 Nov 200900:00 | – | nessus |
| Fedora 10 : tomcat6-6.0.20-1.fc10 (2009-11356) | 30 Nov 200900:00 | – | nessus |
| Fedora 11 : tomcat6-6.0.20-1.fc11 (2009-11374) | 30 Nov 200900:00 | – | nessus |
| GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities | 25 Jun 201200:00 | – | nessus |
| Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities | 29 Mar 201000:00 | – | nessus |
| Mac OS X Multiple Vulnerabilities (Security Update 2010-002) | 29 Mar 201000:00 | – | nessus |
10
source: https://www.securityfocus.com/bid/35196/info
Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists.
Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks.
The following are vulnerable:
Tomcat 4.1.x (prior to 4.1.40)
Tomcat 5.5x (prior to 5.5.28)
Tomcat 6.0.x (prior to 6.0.20)
The following example POST data is available:
POST /j_security_check HTTP/1.1
Host: www.example.com
j_username=tomcat&j_password=%Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Apr 2014 00:00Current
6.3Medium risk
Vulners AI Score6.3
CVSS 24.3
EPSS0.9444