CVE-2011-5063: Improper Authentication in Apache Tomcat
Summary
CVE-2011-5063: Improper Authentication in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.34
>= 6.0.0, < 6.0.33
>= 7.0.0, < 7.0.12
Fixed in 5.5.34, 6.0.33 or 7.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The HTTP Digest Access Authentication implementation in Apache Tomcat versions 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 is vulnerable to an improper authentication issue. This vulnerability allows remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from the HTTP Digest Access Authentication implementation. The affected versions of Apache Tomcat do not properly check realm values, which can be exploited by remote attackers. By leveraging the availability of a protection space with weaker authentication or authorization requirements, attackers can bypass intended access restrictions. This vulnerability is different from CVE-2011-1184. The impact of this vulnerability can lead to unauthorized access to sensitive resources and potential data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.345.5.34 -
>= 6.0.0, < 6.0.336.0.33 -
>= 7.0.0, < 7.0.127.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Apache Tomcat.
Conclusion
The improper authentication vulnerability in Apache Tomcat can be mitigated by upgrading to a fixed version of the software. It is important to promptly apply the recommended fix to prevent potential unauthorized access and data breaches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
This vulnerability allows remote attackers to bypass intended access restrictions, potentially leading to unauthorized access to sensitive resources and data breaches.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Apache Tomcat.
Yes, this vulnerability is different from CVE-2011-1184.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
