CVE-2012-3546: Apache Tomcat

Medium severity, CVSS 4.3. EPSS: 12% chance of exploitation in the next 30 days.

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.

Affected products

• Apache Tomcat: version 6.0 only; version 6.0.0 only; version 6.0.1 only; version 6.0.2 only; version 6.0.3 only; version 6.0.4 only; …

Published 2012-12-19. Last modified 2026-06-16.