SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-30640

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm.

MEDIUM 6.5EPSS 9.89%

Does this matter?

Lower severity and a low EPSS score (9.89%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS
9.89% probability · 95th percentile
CISA KEV
Not listed
Weakness
CWE-116
Affected
apache/tomcat · oracle/communications cloud native core policy · oracle/communications diameter signaling router · oracle/communications pricing design center · oracle/hospitality cruise shipboard property management system · oracle/tekelec platform distribution · debian/debian linux
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.