FreeBSD3383E706-4FC3-11DF-83FB-0015587E2CC1tomcat -- information disclosure vulnerability
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:N/A:N
0.154 Low
EPSS
Percentile
95.8%
The Apache software foundation reports:
The “WWW-Authenticate” header for BASIC and DIGEST
authentication includes a realm name. If a <realm-name>
element is specified for the application in web.xml it
will be used. However, a <realm-name> is not
specified then Tomcat will generate one.
In some circumstances this can expose the local
hostname or IP address of the machine running Tomcat.
References
Related
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:N/A:N
0.154 Low
EPSS
Percentile
95.8%