CVE-2010-1157

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 52.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-23 · updated 2026-06-16
Weakness: CWE-200

Description

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.

Affected products

Apache Tomcat: 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5 (+47)

References

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://marc.info/?l=bugtraq&m=129070310906557&w=2
http://marc.info/?l=bugtraq&m=133469267822771&w=2
http://marc.info/?l=bugtraq&m=136485229118404&w=2
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/39574
http://secunia.com/advisories/42368
http://secunia.com/advisories/43310
http://secunia.com/advisories/57126
http://support.apple.com/kb/HT5002
http://svn.apache.org/viewvc?view=revision&revision=936540

Get alerted when CVE-2010-1157 or the next vulnerability affects your stack