Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-w6q7-ww2x-7gm3
Advisory ID github_osv/GHSA-w6q7-ww2x-7gm3
Aliases CVE-2010-1157
Summary Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
https://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
https://marc.info/?l=bugtraq&m=129070310906557&w=2
https://marc.info/?l=bugtraq&m=133469267822771&w=2
https://marc.info/?l=bugtraq&m=136485229118404&w=2
https://marc.info/?l=bugtraq&m=139344343412337&w=2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19492
https://support.apple.com/kb/HT5002
https://svn.apache.org/viewvc?view=revision&revision=936540
https://svn.apache.org/viewvc?view=revision&revision=936541
https://tomcat.apache.org/security-5.html
https://tomcat.apache.org/security-6.html
https://www.debian.org/security/2011/dsa-2207
CVE-2010-1157 https://nvd.nist.gov/vuln/detail/CVE-2010-1157
Data source Exploit-DB
Date added April 21, 2010
Description Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure
Ransomware campaign use Known
Source publication date April 22, 2010
Exploit type remote
Platform multiple

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.