~ / search / GHSA-hjfh-7c4v-7q8h

GHSA-hjfh-7c4v-7q8h

Improper Authentication in Apache Tomcat

Source: GitHub Advisory Database (reviewed) Moderate CVE-2009-2901

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat >= 5.5.0, < 5.5.29 5.5.29
Maven org.apache.tomcat:tomcat >= 6.0.0, < 6.0.24 6.0.24

Details

As written in the advisory (Markdown source, shown as plain text).

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

References

External links from the advisory. They lead to third-party sites.