NVD

Id
45135  
Name
CVE-2012-3546  
Description
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-05-27  
Published
2012-12-19  
Modified Date
2017-05-22  
Seq
2012-3546  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226515 45135 CVE-2012-3546 20121204 CVE-2012-3546 Apache Tomcat Bypass of security constraints  View
226516 45135 CVE-2012-3546 openSUSE-SU-2012:1700  View
226517 45135 CVE-2012-3546 openSUSE-SU-2012:1701  View
226518 45135 CVE-2012-3546 openSUSE-SU-2013:0147  View
226519 45135 CVE-2012-3546 SSRT101139  View
226520 45135 CVE-2012-3546 HPSBST02955  View
226521 45135 CVE-2012-3546 oval:org.mitre.oval:def:19305  View
226522 45135 CVE-2012-3546 RHSA-2013:0004  View
226523 45135 CVE-2012-3546 RHSA-2013:0005  View
226524 45135 CVE-2012-3546 RHSA-2013:0146  View
226525 45135 CVE-2012-3546 RHSA-2013:0147  View
226526 45135 CVE-2012-3546 RHSA-2013:0151  View
226527 45135 CVE-2012-3546 RHSA-2013:0157  View
226528 45135 CVE-2012-3546 RHSA-2013:0158  View
226529 45135 CVE-2012-3546 RHSA-2013:0162  View
226530 45135 CVE-2012-3546 RHSA-2013:0163  View
226531 45135 CVE-2012-3546 RHSA-2013:0164  View
226532 45135 CVE-2012-3546 RHSA-2013:0191  View
226533 45135 CVE-2012-3546 RHSA-2013:0192  View
226534 45135 CVE-2012-3546 RHSA-2013:0193  View
226535 45135 CVE-2012-3546 RHSA-2013:0194  View
226536 45135 CVE-2012-3546 RHSA-2013:0195  View
226537 45135 CVE-2012-3546 RHSA-2013:0196  View
226538 45135 CVE-2012-3546 RHSA-2013:0197  View
226539 45135 CVE-2012-3546 RHSA-2013:0198  View
226540 45135 CVE-2012-3546 RHSA-2013:0221  View
226541 45135 CVE-2012-3546 RHSA-2013:0235  View
226542 45135 CVE-2012-3546 RHSA-2013:0623  View
226543 45135 CVE-2012-3546 RHSA-2013:0640  View
226544 45135 CVE-2012-3546 RHSA-2013:0641  View
226545 45135 CVE-2012-3546 RHSA-2013:0642  View
226546 45135 CVE-2012-3546 http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java?r1=1377892&r2=1377891&pathrev=1377892  View
226547 45135 CVE-2012-3546 http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1377892&r2=1377891&pathrev=1377892  View
226548 45135 CVE-2012-3546 http://svn.apache.org/viewvc?view=revision&revision=1377892  View
226549 45135 CVE-2012-3546 http://tomcat.apache.org/security-6.html  View
226550 45135 CVE-2012-3546 http://tomcat.apache.org/security-7.html  View
226551 45135 CVE-2012-3546 1027833  View
226552 45135 CVE-2012-3546 USN-1685-1  View
226553 45135 CVE-2012-3546 HPSBMU02873  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30042 JVNDB-2012-005749 Apache Tomcat における security-constraint のチェックを回避される脆弱性 Apache Tomcat の org/apache/catalina/realm/RealmBase.java には、FORM 認証が使用される際、security-constraint のチェックを回避される脆弱性が存在します。 CVE-2012-3546 56784 CVE-2012-3546 45135 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005749.html 2012-12-04 2015-03-09 View