CVE-2016-0762
tomcat: timing attack in Realm implementation
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 27, 2016
Updated · August 5, 2026
Description
The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 · 2.6AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE not specified