VULNERABILITY INTELLIGENCE

CVE-2016-0762

CVSS score5.9 MEDIUM

EPSS probability7.99%

CISA KEVNot currently listed

Published2017-08-10

Last modified2026-10-08

Description

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note tha... .