CVE-2021-30640

MEDIUM

Apache Tomcat <10.0.6, <9.0.46, <8.5.66 - Auth Bypass

Title source: llm
STIX 2.1

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

References (9)

Core 9
Core References
Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4952
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4986
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210827-0007/
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-34

Scores

CVSS v3 6.5
EPSS 0.0012
EPSS Percentile 30.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Details

CWE
CWE-116
Status published
Products (10)
apache/tomcat 7.0.0 - 7.0.109
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
oracle/communications_cloud_native_core_policy 1.14.0
oracle/communications_diameter_signaling_router 8.0.0 - 8.5.0
oracle/communications_pricing_design_center 12.0.0.3.0
oracle/hospitality_cruise_shipboard_property_management_system 20.1.0
oracle/tekelec_platform_distribution 7.4.0 - 7.7.1
org.apache.tomcat/tomcat 10.0.0-M1 - 10.0.5Maven
Published Jul 12, 2021
Tracked Since Feb 18, 2026