Description
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
References (26)
Core 26
Core References
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:156
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5130
Mailing List vendor-advisory
x_refsource_hp
http://marc.info/?l=bugtraq&m=136485229118404&w=2
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1845.html
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-7.html
Mailing List vendor-advisory
x_refsource_hp
http://marc.info/?l=bugtraq&m=133469267822771&w=2
Mailing List vendor-advisory
x_refsource_hp
http://marc.info/?l=bugtraq&m=132215163318824&w=2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/68238
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-6.html
Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=717013
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2012/dsa-2401
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48308
Mailing List vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1025712
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/57126
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14931
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/73429
Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-5.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44981
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/48456
Mailing List vendor-advisory
x_refsource_hp
http://marc.info/?l=bugtraq&m=139344343412337&w=2
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
Scores
EPSS
0.0067
EPSS Percentile
47.5%
Details
CWE
CWE-200
Status
published
Products (50)
apache/tomcat
5.5.0
apache/tomcat
5.5.1
apache/tomcat
5.5.2
apache/tomcat
5.5.3
apache/tomcat
5.5.4
apache/tomcat
5.5.5
apache/tomcat
5.5.6
apache/tomcat
5.5.7
apache/tomcat
5.5.8
apache/tomcat
5.5.9
... and 40 more
Published
Jun 29, 2011
Tracked Since
Feb 18, 2026