CVE-2012-3546

描述

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.

如何修補 CVE-2012-3546

要修補 CVE-2012-3546,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 6.0.36 或更新版本

CVE-2012-3546 正在被利用嗎?

中等 — EPSS 為 12.0%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 6.0.0, < 6.0.36

參考連結(37)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-3546
• PATCHgithub.com/apache/tomcat
• WEBlists.opensuse.org/opensuse-updates/2012-12/msg00089.html
• WEBlists.opensuse.org/opensuse-updates/2012-12/msg00090.html
• WEB