Fixed in Apache Tomcat 9.0.46

2021-05-1200:00:00

Apache Tomcat

tomcat.apache.org

apache tomcat

authentication weakness

jndi realm

parameter values

lockout realm

vulnerability fix

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS

0.002

Percentile

58.4%

JSON

Low: Authentication weakness CVE-2021-30640

Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

This was fixed with commits c4df8d44, 749f3cc1, c6b6e101, 91ecdc61, e5006748, b5585a9e, 32993201 and 3ce84512.

This issue was reported publicly as 65224.

Affects: 9.0.0.M1 to 9.0.45