QwikSec

Security Database

CVE

CWE

Training

CVE-2021-30640

Published: Jul 12, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	affected `Apache Tomcat 10 10.0.0-M1 to 10.0.5` affected `Apache Tomcat 9 9.0.0.M1 to 9.0.45` affected `Apache Tomcat 8.5 8.5.0 to 8.5.65` affected `Apache Tomcat 7 7.0.0 to 7.0.108`

References

https://lists.apache.org/thread.html/r59f9ef03929d32120f91f4ea7e6e79edd5688d75d0a9b65fd26d1fe8%40%3Cannounce.tomcat.apache.org%3E

x_refsource_MISC

https://www.oracle.com//security-alerts/cpujul2021.html

x_refsource_MISC

[debian-lts-announce] 20210805 [SECURITY] [DLA 2733-1] tomcat8 security update

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_DEBIAN

vendor-advisory

x_refsource_DEBIAN

https://www.oracle.com/security-alerts/cpuoct2021.html

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20210827-0007/

x_refsource_CONFIRM

https://www.oracle.com/security-alerts/cpujan2022.html

x_refsource_MISC

vendor-advisory

x_refsource_GENTOO

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.