← Back

CVE-2021-30640

nvd nist
Published: Jul 12, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Exploitability: 2.2 / Impact: 4.2
Source: NVD

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Affected (12)

Apache
1 product
Tomcat
Oracle
5 products
Communications Cloud Native Core Policy
Communications Diameter Signaling Router
Communications Pricing Design Center
Hospitality Cruise Shipboard Property Management System
Tekelec Platform Distribution
Debian
1 product
Debian Linux
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
From 10.0.0 to 10.0.6
Tomcat
From 7.0.0 to 7.0.109
Tomcat
From 8.5.0 to 8.5.66
Tomcat
From 9.0.0 to 9.0.46
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Communications Cloud Native Core Policy
Version 1.14.0
Communications Diameter Signaling Router
From 8.0.0 to 8.5.0
Communications Pricing Design Center
Version 12.0.0.3.0
Hospitality Cruise Shipboard Property Management System
Version 20.1.0
Tekelec Platform Distribution
From 7.4.0 to 7.7.1
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Debian Linux
Version 9.0

Related CWEs

CWE-116
Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (18)

Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.