CVE-2011-2204: Infoleak
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
Other sources
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
— GitHub
From the upstream advisory notes [1]:
When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.
This is fixed in Tomcat 5.5.34 (not yet released) [2] and Tomcat 6.0.33 (not yet released) [3].
[1] http://tomcat.apache.org/security-5.html [2] http://svn.apache.org/viewvc?view=revision&revision=1140072 [2] http://svn.apache.org/viewvc?view=revision&revision=1140071
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2204?
CVE-2011-2204 has been classified as a medium severity vulnerability, primarily due to the potential exposure of sensitive information.
How do I fix CVE-2011-2204?
To fix CVE-2011-2204, upgrade to Apache Tomcat version 5.5.34, 6.0.33, or 7.0.17 or later.
What versions of Apache Tomcat are affected by CVE-2011-2204?
CVE-2011-2204 affects Apache Tomcat versions prior to 5.5.34, 6.0.33, and 7.0.17.
What type of information is exposed in CVE-2011-2204?
CVE-2011-2204 could expose usernames and passwords in the log files when errors occur during JMX user creation.
Who can exploit CVE-2011-2204?
CVE-2011-2204 can be exploited by local users who have access to the log files where sensitive information is written.