-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 5.5.0, < 5.5.34 | 5.5.34 |
| org.apache.tomcat:tomcat | maven | >= 6.0.0, < 6.0.33 | 6.0.33 |
| org.apache.tomcat:tomcat | maven | >= 7.0.0, < 7.0.12 | 7.0.12 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2011-5063 stems from improper realm validation in Tomcat's DigestAuthenticator. Analysis of the commit diff shows the vulnerable findPrincipal method was replaced with a new DigestInfo validation class that added realm checks. The original implementation lacked realm comparison logic (comparing request realm against config.getRealmName()), which allowed realm spoofing. The patch explicitly adds realm validation in DigestInfo.validate(), confirming this was the missing security check.