{"id":"CVE-2021-30640","published":"2021-07-12T14:55:13Z","modified":"2026-10-08T21:03:16Z","title":"Auth weakness in JNDIRealm","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.09886,"percentile":0.95555,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r59f9ef03929d32120f91f4ea7e6e79edd5688d75d0a9b65fd26d1fe8%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-4952","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.debian.org/security/2021/dsa-4986","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202208-34","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":19.11}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["Apache Tomcat 10 10.0.0-M1 to 10.0.5","Apache Tomcat 9 9.0.0.M1 to 9.0.45","Apache Tomcat 8.5 8.5.0 to 8.5.65","Apache Tomcat 7 7.0.0 to 7.0.108"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=10.0.0-M1, <10.0.5",">=9.0.0M1, <9.0.45",">=8.5.0, <8.5.65"],"patched":["10.0.5","9.0.45","8.5.65"],"from":["GHSA-36qh-35cm-5w2w"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1533","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13935","published":"2020-07-14","fixed":"10.0.0-M7","kev":false},{"cve":"CVE-2021-41079","published":"2021-09-16","fixed":"10.0.4","kev":false},{"cve":"CVE-2021-30639","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-30640","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-33037","published":"2021-07-12","fixed":"10.0.7","kev":false,"link":{"from":"CVE-2021-30640","to":"CVE-2021-33037","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.45","toFixed":"9.0.48","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.65","toFixed":"8.5.68","daysApart":0}]}},{"cve":"CVE-2022-23181","published":"2022-01-27","fixed":"10.0.16","kev":false},{"cve":"CVE-2021-43980","published":"2022-09-28","fixed":"10.1.0-M14","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}