-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly states that DigestAuthenticator.java uses 'Catalina' as a hard-coded server secret. The CVE (CVE-2011-5064) and associated commit diffs (e.g., SVN rev 1087655) confirm that the fix involved making this secret configurable. The hard-coded value in the authentication logic directly introduces the vulnerability by using a predictable cryptographic key.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 5.5.0, < 5.5.34 | 5.5.34 |
| org.apache.tomcat:tomcat | maven | >= 6.0.0, < 6.0.33 | 6.0.33 |
| org.apache.tomcat:tomcat | maven | >= 7.0.0, < 7.0.12 | 7.0.12 |