CVE: 2021-30640 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Access Restriction Bypass
Vulnerability description	tomcat-catalina is vulnerable to access restriction bypass. Lack of proper sanitization of user provided parameter or configuration data provided by an administrator accept authentication using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.
CVE	2021-30640
CVSS score	5.8
Vulnerability present in version/s	9.0.0.M1-9.0.45
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.46
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/31185
• Patch: apache/tomcat@c6b6e10