CVE-2010-1157: Exposure of Sensitive Information in Apache Tomcat
Summary
CVE-2010-1157: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 5.5.0, < 5.5.30
>= 6.0.0, < 6.0.28
Fixed in 5.5.30 or 6.0.28, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications, supporting various protocols and technologies. However, versions 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 of Apache Tomcat are vulnerable to an information exposure issue.
Vulnerability Detail
The vulnerability in Apache Tomcat allows remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires either BASIC or DIGEST authentication. By reading the realm field in the WWW-Authenticate header in the server's reply, an unauthorized actor can obtain sensitive information about the server's location. This information can be used for further attacks or reconnaissance.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.305.5.30 -
>= 6.0.0, < 6.0.286.0.28
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to a secure version of Apache Tomcat.
Conclusion
In conclusion, Apache Tomcat versions 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 are vulnerable to an information exposure issue. By upgrading to the latest secure version, users can mitigate this vulnerability and protect their server from potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.
Versions 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 of Apache Tomcat are affected.
An attacker can send a request for a resource that requires authentication and read the realm field in the server's reply to obtain the server's hostname or IP address.
The exposure of the server's hostname or IP address can aid attackers in further attacks or reconnaissance.
No specific workaround is mentioned. It is recommended to upgrade to a secure version of Apache Tomcat.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
