CVE-2010-1157

Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure

Severity Score

2.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.

Apache Tomcat en sus versiones v5.5.0 a v5.5.29 y v6.0.0 a v6.0.26 podría permitir a atacantes remotos descubrir el nombre del servidor o su dirección IP mediante el envío de una solicitud de un recurso que requiere autenticación (1) BASIC o (2) DIGEST, y leer a continuación el campo realm en la cabecera WWW-Authenticate de la respuesta.

*Credits: N/A

CVSS Scores

NISTv2 2.6

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-03-29 CVE Reserved
2010-04-22 First Exploit
2010-04-23 CVE Published
2024-03-11 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (35)

URL	Tag	Source
http://secunia.com/advisories/57126	Third Party Advisory
http://support.apple.com/kb/HT5002	X_refsource_confirm
http://www.securityfocus.com/archive/1/510879/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/516397/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/39635	Vdb Entry
http://www.vmware.com/security/advisories/VMSA-2011-0003.html	X_refsource_confirm
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html	X_refsource_confirm
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19492	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/12343	2010-04-22

URL	Date	SRC
http://svn.apache.org/viewvc?view=revision&revision=936540	2023-02-13
http://svn.apache.org/viewvc?view=revision&revision=936541	2023-02-13
http://tomcat.apache.org/security-5.html	2023-02-13
http://tomcat.apache.org/security-6.html	2023-02-13

URL	Date	SRC
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html	2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	2023-02-13
http://marc.info/?l=bugtraq&m=129070310906557&w=2	2023-02-13
http://marc.info/?l=bugtraq&m=133469267822771&w=2	2023-02-13
http://marc.info/?l=bugtraq&m=136485229118404&w=2	2023-02-13
http://marc.info/?l=bugtraq&m=139344343412337&w=2	2023-02-13
http://secunia.com/advisories/39574	2023-02-13
http://secunia.com/advisories/42368	2023-02-13
http://secunia.com/advisories/43310	2023-02-13
http://www.debian.org/security/2011/dsa-2207	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:177	2023-02-13
http://www.redhat.com/support/errata/RHSA-2011-0896.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2011-0897.html	2023-02-13
http://www.vupen.com/english/advisories/2010/0980	2023-02-13
http://www.vupen.com/english/advisories/2010/3056	2023-02-13
https://access.redhat.com/security/cve/CVE-2010-1157	2011-06-22
https://bugzilla.redhat.com/show_bug.cgi?id=585331	2011-06-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.0 Search vendor "Apache" for product "Tomcat" and version "5.5.0"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.1 Search vendor "Apache" for product "Tomcat" and version "5.5.1"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.2 Search vendor "Apache" for product "Tomcat" and version "5.5.2"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.3 Search vendor "Apache" for product "Tomcat" and version "5.5.3"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.4 Search vendor "Apache" for product "Tomcat" and version "5.5.4"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.5 Search vendor "Apache" for product "Tomcat" and version "5.5.5"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.6 Search vendor "Apache" for product "Tomcat" and version "5.5.6"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.7 Search vendor "Apache" for product "Tomcat" and version "5.5.7"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.8 Search vendor "Apache" for product "Tomcat" and version "5.5.8"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.9 Search vendor "Apache" for product "Tomcat" and version "5.5.9"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.10 Search vendor "Apache" for product "Tomcat" and version "5.5.10"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.11 Search vendor "Apache" for product "Tomcat" and version "5.5.11"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.12 Search vendor "Apache" for product "Tomcat" and version "5.5.12"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.13 Search vendor "Apache" for product "Tomcat" and version "5.5.13"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.14 Search vendor "Apache" for product "Tomcat" and version "5.5.14"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.15 Search vendor "Apache" for product "Tomcat" and version "5.5.15"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.16 Search vendor "Apache" for product "Tomcat" and version "5.5.16"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.17 Search vendor "Apache" for product "Tomcat" and version "5.5.17"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.18 Search vendor "Apache" for product "Tomcat" and version "5.5.18"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.19 Search vendor "Apache" for product "Tomcat" and version "5.5.19"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.20 Search vendor "Apache" for product "Tomcat" and version "5.5.20"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.21 Search vendor "Apache" for product "Tomcat" and version "5.5.21"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.22 Search vendor "Apache" for product "Tomcat" and version "5.5.22"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.23 Search vendor "Apache" for product "Tomcat" and version "5.5.23"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.24 Search vendor "Apache" for product "Tomcat" and version "5.5.24"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.25 Search vendor "Apache" for product "Tomcat" and version "5.5.25"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.26 Search vendor "Apache" for product "Tomcat" and version "5.5.26"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.27 Search vendor "Apache" for product "Tomcat" and version "5.5.27"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.28 Search vendor "Apache" for product "Tomcat" and version "5.5.28"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				5.5.29 Search vendor "Apache" for product "Tomcat" and version "5.5.29"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.0 Search vendor "Apache" for product "Tomcat" and version "6.0.0"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.1 Search vendor "Apache" for product "Tomcat" and version "6.0.1"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.2 Search vendor "Apache" for product "Tomcat" and version "6.0.2"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.3 Search vendor "Apache" for product "Tomcat" and version "6.0.3"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.4 Search vendor "Apache" for product "Tomcat" and version "6.0.4"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.5 Search vendor "Apache" for product "Tomcat" and version "6.0.5"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.6 Search vendor "Apache" for product "Tomcat" and version "6.0.6"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.7 Search vendor "Apache" for product "Tomcat" and version "6.0.7"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.8 Search vendor "Apache" for product "Tomcat" and version "6.0.8"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.9 Search vendor "Apache" for product "Tomcat" and version "6.0.9"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.10 Search vendor "Apache" for product "Tomcat" and version "6.0.10"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.11 Search vendor "Apache" for product "Tomcat" and version "6.0.11"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.12 Search vendor "Apache" for product "Tomcat" and version "6.0.12"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.13 Search vendor "Apache" for product "Tomcat" and version "6.0.13"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.14 Search vendor "Apache" for product "Tomcat" and version "6.0.14"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.15 Search vendor "Apache" for product "Tomcat" and version "6.0.15"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.16 Search vendor "Apache" for product "Tomcat" and version "6.0.16"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.17 Search vendor "Apache" for product "Tomcat" and version "6.0.17"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.18 Search vendor "Apache" for product "Tomcat" and version "6.0.18"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.19 Search vendor "Apache" for product "Tomcat" and version "6.0.19"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.20 Search vendor "Apache" for product "Tomcat" and version "6.0.20"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.24 Search vendor "Apache" for product "Tomcat" and version "6.0.24"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				6.0.26 Search vendor "Apache" for product "Tomcat" and version "6.0.26"		-		Affected