Description
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
Remediation
References
Related Vulnerabilities
PHP Out-of-bounds Read Vulnerability (CVE-2016-9935)
WordPress Plugin G-Lock Double Opt-in Manager 'ajaxbackend.php' SQL Injection (2.6.2)
WordPress Plugin Email newsletter 'option' Parameter Information Disclosure (8.0)
Apache Tomcat Unprotected Transport of Credentials Vulnerability (CVE-2023-28708)
PostgreSQL Improper Authentication Vulnerability (CVE-2009-3231)