CVE-2021-30640
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
- Affected products
- Alt Linux, Apache Tomcat, Astra Linux, Linuxmint, Red Os, Suse, Ubuntu
- Apache Tomcat
- < 7.0.109, 8.5.66, 9.0.46, 10.0.6
- Fix
- Available
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 9.9% (95th percentile)
- Weakness
- CWE-116
- NVD status
- Modified
- Published
- 2021-07-12
CVE-2021-30640 at NVD
No indexed exploits for CVE-2021-30640 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-30640 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.