CVE-2011-2204: Insertion of Sensitive Information into Log File in Apache Tomcat
Summary
CVE-2011-2204: Insertion of Sensitive Information into Log File in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.34
>= 6.0.0, < 6.0.33
>= 7.0.0, < 7.0.19
Fixed in 5.5.34, 6.0.33 or 7.0.19, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The MemoryUserDatabase is a component in Apache Tomcat that allows user information to be stored in memory rather than in a database. This vulnerability affects Apache Tomcat versions 5.5.x, 6.x, and 7.x when the MemoryUserDatabase is used.
Vulnerability Detail
The vulnerability in Apache Tomcat allows local users to obtain sensitive information by reading a log file. When encountering errors in JMX user creation, Apache Tomcat creates log entries containing passwords. This means that if an error occurs during the creation of a JMX user, the password for that user will be logged. An attacker with local access to the system can read the log file and obtain the passwords, potentially gaining unauthorized access to the system or other sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.345.5.34 -
>= 6.0.0, < 6.0.336.0.33 -
>= 7.0.0, < 7.0.197.0.19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache Tomcat allows local users to obtain sensitive information by reading a log file. It is recommended to upgrade to Apache Tomcat 7.0.19 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The MemoryUserDatabase is a component in Apache Tomcat that allows user information to be stored in memory rather than in a database.
This vulnerability occurs when Apache Tomcat encounters errors in JMX user creation and logs entries containing passwords.
The potential consequences of this vulnerability include unauthorized access to the system or other sensitive information if an attacker can read the log file containing the passwords.
To fix this vulnerability, upgrade to Apache Tomcat version 7.0.19 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
