Access Restriction Bypass Affecting org.apache.tomcat.embed:tomcat-embed-core package, versions [7.0.0,7.0.12)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.18% (57th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGAPACHETOMCATEMBED-30968
  • published9 Jan 2014
  • disclosed14 Jan 2012
  • creditUnknown

Introduced: 14 Jan 2012

CVE-2011-5062  (opens in a new tab)
CWE-264  (opens in a new tab)

Overview

org.apache.tomcat.embed:tomcat-embed-core The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

References

CVSS Scores

version 3.1