CVE-2012-3546

2012-12-1900:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.7%

JSON

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36
and 7.x before 7.0.30, when FORM authentication is used, allows remote
attackers to bypass security-constraint checks by leveraging a previous
setUserPrincipal call and then placing /j_security_check at the end of a
URI.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695251 (tomcat7)>
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695250 (tomcat6)>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchtomcat6< 6.0.24-2ubuntu1.12UNKNOWN
ubuntu11.10noarchtomcat6< 6.0.32-5ubuntu1.4UNKNOWN
ubuntu12.04noarchtomcat6< 6.0.35-1ubuntu3.2UNKNOWN
ubuntu12.10noarchtomcat6< 6.0.35-5ubuntu0.1UNKNOWN
ubuntu11.10noarchtomcat7< 7.0.21-1ubuntu0.1UNKNOWN
ubuntu12.04noarchtomcat7< 7.0.26-1ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	tomcat6	< 6.0.24-2ubuntu1.12	UNKNOWN
ubuntu	11.10	noarch	tomcat6	< 6.0.32-5ubuntu1.4	UNKNOWN
ubuntu	12.04	noarch	tomcat6	< 6.0.35-1ubuntu3.2	UNKNOWN
ubuntu	12.10	noarch	tomcat6	< 6.0.35-5ubuntu0.1	UNKNOWN
ubuntu	11.10	noarch	tomcat7	< 7.0.21-1ubuntu0.1	UNKNOWN
ubuntu	12.04	noarch	tomcat7	< 7.0.26-1ubuntu1.2	UNKNOWN