Apache Tomcat vulnerable to Unprotected Transport of Credentials

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-28708 · ADVISORY
• apache/tomcat commit 3b51230 · WEB
• apache/tomcat commit 5b72c94 · WEB
• apache/tomcat commit c64d496 · WEB
• apache/tomcat commit f509bbf · WEB
• bz.apache.org/bugzilla/show_bug.cgi · WEB
• apache/tomcat · PACKAGE
• lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 · WEB
• security.netapp.com/advisory/ntap-20230331-0012 · WEB
• tomcat.apache.org/security-10.html · WEB
• tomcat.apache.org/security-11.html · WEB
• tomcat.apache.org/security-8.html

org.apache.tomcat:tomcat-catalina のその他の脆弱性

• CVE-2026-68525緊急 9.1Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limi…
• CVE-2026-65905緊急 9.8Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made…
• CVE-2026-65182緊急 9.1Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a lo…
• CVE-2026-43515緊急 9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This i…
• CVE-2026-43514低 3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 th…