CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
69.2%
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36
and 7.x before 7.0.30, when FORM authentication is used, allows remote
attackers to bypass security-constraint checks by leveraging a previous
setUserPrincipal call and then placing /j_security_check at the end of a
URI.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 10.04 | noarch | tomcat6 | <ย 6.0.24-2ubuntu1.12 | UNKNOWN |
ubuntu | 11.10 | noarch | tomcat6 | <ย 6.0.32-5ubuntu1.4 | UNKNOWN |
ubuntu | 12.04 | noarch | tomcat6 | <ย 6.0.35-1ubuntu3.2 | UNKNOWN |
ubuntu | 12.10 | noarch | tomcat6 | <ย 6.0.35-5ubuntu0.1 | UNKNOWN |
ubuntu | 11.10 | noarch | tomcat7 | <ย 7.0.21-1ubuntu0.1 | UNKNOWN |
ubuntu | 12.04 | noarch | tomcat7 | <ย 7.0.26-1ubuntu1.2 | UNKNOWN |
archives.neohapsis.com/archives/bugtraq/2012-12/0044.html
tomcat.apache.org/security-6.html
tomcat.apache.org/security-7.html
launchpad.net/bugs/cve/CVE-2012-3546
nvd.nist.gov/vuln/detail/CVE-2012-3546
security-tracker.debian.org/tracker/CVE-2012-3546
ubuntu.com/security/notices/USN-1685-1
www.cve.org/CVERecord?id=CVE-2012-3546