UpHeron
All vulnerabilities

Servers and applications

CVE-2016-0762

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this…

Severity
Medium 5.9
Published
10 Aug 2017
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone6
All 13 release lines
  • From 6.0.0 up to 6.0.45
  • From 7.0.0 up to 7.0.70
  • From 8.0 up to 8.0.36
  • From 8.5.0 up to 8.5.4
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone2
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone5
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-0762
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-0762