• The following problems were fixed in Apache Tomcat version 7.0.30:
  
  
  • Important: Bypass of security constraints CVE-2012-3546
    When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending /j_security_check to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate(). This was fixed in revision 1377892.
  • DIGEST authentication weakness CVE-2012-3439
    Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:
    Tomcat tracked client rather than server nonces and nonce count.
    When a session ID was present, authentication was bypassed.
    The user name and password were not checked before when indicating that a nonce was stale.
    These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.
  
  
  Affected Apache Tomcat versions (7.0.0 - 7.0.31).
  

• Upgrade to the latest version of Apache Tomcat.

• • CVE-2012-3439
  • CVE-2012-3546
  • Apache Tomcat 7.x vulnerabilities

• 

• CVE-2012-3439

  CVE-2012-3544

  CVE-2012-3546

• CWE-20

• Configuration Missing Update

• WordPress Plugin Filtre de Surveillance Gouvernemental Cross-Site Scripting (1.1)
• WordPress Plugin Google XML Sitemaps Cross-Site Scripting (4.0.8)
• WordPress Plugin Fast Secure Contact Form-Clockwork SMS Cross-Site Scripting (2.1.2)
• WordPress Plugin Aesop Story Engine Cross-Site Scripting (1.6)
• WordPress Plugin WP e-Commerce Shop Styling Remote File Inclusion (1.7.2)