CVE-2011-2204
Insertion of Sensitive Information into Log File in Apache Tomcat
EPSS 0.67%
描述
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
如何修補 CVE-2011-2204
要修補 CVE-2011-2204,請將受影響套件升級到下列已修補版本。
- —升級至 5.5.34 或更新版本
CVE-2011-2204 正在被利用嗎?
低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 5.5.0, < 5.5.34