#VU100588 Improper Authentication in Apache Tomcat
Vulnerability identifier: #VU100588
Vulnerability risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-287
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Apache Tomcat
Server applications /
Web servers
Vendor: Apache Foundation
Description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests. If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Apache Tomcat: 9.0.0-M1 - 9.0.95, 10.0.0-M1 - 10.0.27, 10.1.0-M1 - 10.1.30, 11.0.0-M1 - 11.0.0-M26
External links
http://tomcat.apache.org/security-9.html
http://tomcat.apache.org/security-10.html
http://tomcat.apache.org/security-11.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
