vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-30640

Auth weakness in JNDIRealm

MEDIUM
6.5
CVSS Score
Published: July 12, 2021 at 02:55 PM UTC
Updated: October 8, 2026 at 09:17 PM UTC
7 products affected across 3 vendorsDebian LinuxTomcatCommunications Cloud Native Core Policy

Using Apache Tomcat by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 10%
SSVC
No known exploit

Description

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tomcat· Apache
95%
10.0.0 ≤ v < 10.0.67.0.0 ≤ v < 7.0.1098.5.0 ≤ v < 8.5.669.0.0 ≤ v < 9.0.46*Apache Tomcat 10 10.0.0-M1 to 10.0.5Apache Tomcat 7 7.0.0 to 7.0.108Apache Tomcat 8.5 8.5.0 to 8.5.65Apache Tomcat 9 9.0.0.M1 to 9.0.45
Affected range stops below 10.0.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.0.109, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.5.66, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.46, so it looks safe — our inference, not a vendor statement
Debian Linux· Debiandrupal
95%
10.011.09.0
Communications Cloud Native Core Policy· Oracle
95%
1.14.0
Communications Diameter Signaling Router· Oracle
95%
8.0.0 ≤ v ≤ 8.5.0*
Communications Pricing Design Center· Oraclenpm
95%
12.0.0.3.0
Hospitality Cruise Shipboard Property Management System· Oracle
95%
20.1.0
Tekelec Platform Distribution· Oracle
95%
7.4.0 ≤ v ≤ 7.7.1*

References (9)

x_refsource_MISCMailing ListVendor Advisory
Source: [email protected]
https://lists.apache.org/thread.html/r59f9ef03929d32120f91f4ea7e6e79edd5688d75d0a9b65fd26d1fe8%40%3Cannounce.tomcat.apache.org%3E
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html
Vendor Advisoryx_refsource_GENTOOThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202208-34
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20210827-0007/
Vendor Advisoryx_refsource_DEBIANThird Party Advisory
Source: [email protected]
https://www.debian.org/security/2021/dsa-4952
Vendor Advisoryx_refsource_DEBIANThird Party Advisory
Source: [email protected]
https://www.debian.org/security/2021/dsa-4986
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.oracle.com//security-alerts/cpujul2021.html
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://www.oracle.com/security-alerts/cpujan2022.html

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-116

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card