CVE-2021-30640: tomcat from 7.0.0 (inclusive), before 7.0.109 (exclusive), from 8.5.0 (inclusive), before 8.5.66 (exclusive), from…

Affected technology

tomcat · from 7.0.0 (inclusive), before 7.0.109 (exclusive)
apache

tomcat · from 8.5.0 (inclusive), before 8.5.66 (exclusive)
apache

tomcat · from 9.0.0 (inclusive), before 9.0.46 (exclusive)
apache

tomcat · from 10.0.0 (inclusive), before 10.0.6 (exclusive)
apache

communications cloud native core policy · 1.14.0
oracle

communications diameter signaling router · from 8.0.0 (inclusive), through 8.5.0 (inclusive)
oracle

communications pricing design center · 12.0.0.3.0
oracle

hospitality cruise shipboard property management system · 20.1.0
oracle

tekelec platform distribution · from 7.4.0 (inclusive), through 7.7.1 (inclusive)
oracle

debian linux · 9.0
debian

debian linux · 10.0
debian

debian linux · 11.0
debian

Apache Tomcat · Apache Tomcat 10 10.0.0-M1 to 10.0.5, Apache Tomcat 9 9.0.0.M1 to 9.0.45, Apache Tomcat 8.5 8.5.0 to 8.5.65, Apache Tomcat 7 7.0.0 to 7.0.108
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.