GHSA-hjfh-7c4v-7q8h

Suggest an improvement
Source
https://github.com/advisories/GHSA-hjfh-7c4v-7q8h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hjfh-7c4v-7q8h/GHSA-hjfh-7c4v-7q8h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hjfh-7c4v-7q8h
Aliases
  • CVE-2009-2901
Published
2022-05-02T03:39:47Z
Modified
2024-02-21T16:53:18Z
Summary
Improper Authentication in Apache Tomcat
Details

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

Database specific 
{
    "nvd_published_at": "2010-01-28T20:30:00Z",
    "github_reviewed_at": "2022-06-17T17:20:31Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.5.29

Database specific

last_known_affected_version_range 
"<= 5.5.28"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hjfh-7c4v-7q8h/GHSA-hjfh-7c4v-7q8h.json"

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.24

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hjfh-7c4v-7q8h/GHSA-hjfh-7c4v-7q8h.json"