Description

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

Remediation

References

CVE-2011-5062

Related Vulnerabilities

WordPress Plugin Events Made Easy PHP Object Injection (2.0.52)

WordPress Plugin Ad-Manager Open Redirect (1.1.2)

WordPress Plugin Floating Chat Widget:Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button-Chaty Multiple Cross-Site Scripting Vulnerabilities (2.8.3)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12245)

Oracle Application Server Other Vulnerability (CVE-2002-0842)

Severity

Medium

Classification

CVE-2011-5062 CWE-264

Tags

Missing Update Known Vulnerabilities