NVD Vulnerability Detail

CVE-2012-3546

Summary	org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
Publication Date	Dec. 19, 2012, 8:55 p.m.
Registration Date	Jan. 28, 2021, 3 p.m.
Last Update	Nov. 21, 2024, 10:41 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:beta::::::
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.31:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2012-12/0044.html
2	http://archives.neohapsis.com/archives/bugtraq/2012-12/0044.html
3	http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
4	http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
5	http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
6	http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
7	http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
8	http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
9	http://marc.info/?l=bugtraq&m=136612293908376&w=2
10	http://marc.info/?l=bugtraq&m=136612293908376&w=2
11	http://marc.info/?l=bugtraq&m=136612293908376&w=2
12	http://marc.info/?l=bugtraq&m=136612293908376&w=2
13	http://marc.info/?l=bugtraq&m=139344343412337&w=2
14	http://marc.info/?l=bugtraq&m=139344343412337&w=2
15	http://rhn.redhat.com/errata/RHSA-2013-0004.html
16	http://rhn.redhat.com/errata/RHSA-2013-0004.html
17	http://rhn.redhat.com/errata/RHSA-2013-0005.html
18	http://rhn.redhat.com/errata/RHSA-2013-0005.html
19	http://rhn.redhat.com/errata/RHSA-2013-0146.html
20	http://rhn.redhat.com/errata/RHSA-2013-0146.html
21	http://rhn.redhat.com/errata/RHSA-2013-0147.html
22	http://rhn.redhat.com/errata/RHSA-2013-0147.html
23	http://rhn.redhat.com/errata/RHSA-2013-0151.html
24	http://rhn.redhat.com/errata/RHSA-2013-0151.html
25	http://rhn.redhat.com/errata/RHSA-2013-0157.html
26	http://rhn.redhat.com/errata/RHSA-2013-0157.html
27	http://rhn.redhat.com/errata/RHSA-2013-0158.html
28	http://rhn.redhat.com/errata/RHSA-2013-0158.html
29	http://rhn.redhat.com/errata/RHSA-2013-0162.html
30	http://rhn.redhat.com/errata/RHSA-2013-0162.html
31	http://rhn.redhat.com/errata/RHSA-2013-0163.html
32	http://rhn.redhat.com/errata/RHSA-2013-0163.html
33	http://rhn.redhat.com/errata/RHSA-2013-0164.html
34	http://rhn.redhat.com/errata/RHSA-2013-0164.html
35	http://rhn.redhat.com/errata/RHSA-2013-0191.html
36	http://rhn.redhat.com/errata/RHSA-2013-0191.html
37	http://rhn.redhat.com/errata/RHSA-2013-0192.html
38	http://rhn.redhat.com/errata/RHSA-2013-0192.html
39	http://rhn.redhat.com/errata/RHSA-2013-0193.html
40	http://rhn.redhat.com/errata/RHSA-2013-0193.html
41	http://rhn.redhat.com/errata/RHSA-2013-0194.html
42	http://rhn.redhat.com/errata/RHSA-2013-0194.html
43	http://rhn.redhat.com/errata/RHSA-2013-0195.html
44	http://rhn.redhat.com/errata/RHSA-2013-0195.html
45	http://rhn.redhat.com/errata/RHSA-2013-0196.html
46	http://rhn.redhat.com/errata/RHSA-2013-0196.html
47	http://rhn.redhat.com/errata/RHSA-2013-0197.html
48	http://rhn.redhat.com/errata/RHSA-2013-0197.html
49	http://rhn.redhat.com/errata/RHSA-2013-0198.html
50	http://rhn.redhat.com/errata/RHSA-2013-0198.html
51	http://rhn.redhat.com/errata/RHSA-2013-0221.html
52	http://rhn.redhat.com/errata/RHSA-2013-0221.html
53	http://rhn.redhat.com/errata/RHSA-2013-0235.html
54	http://rhn.redhat.com/errata/RHSA-2013-0235.html
55	http://rhn.redhat.com/errata/RHSA-2013-0623.html
56	http://rhn.redhat.com/errata/RHSA-2013-0623.html
57	http://rhn.redhat.com/errata/RHSA-2013-0640.html
58	http://rhn.redhat.com/errata/RHSA-2013-0640.html
59	http://rhn.redhat.com/errata/RHSA-2013-0641.html
60	http://rhn.redhat.com/errata/RHSA-2013-0641.html
61	http://rhn.redhat.com/errata/RHSA-2013-0642.html
62	http://rhn.redhat.com/errata/RHSA-2013-0642.html
63	http://secunia.com/advisories/51984
64	http://secunia.com/advisories/51984
65	http://secunia.com/advisories/52054
66	http://secunia.com/advisories/52054
67	http://secunia.com/advisories/57126
68	http://secunia.com/advisories/57126
69	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java?r1=1377892&r2=1377891&pathrev=1377892	Patch
70	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java?r1=1377892&r2=1377891&pathrev=1377892	Patch
71	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1377892&r2=1377891&pathrev=1377892	Patch
72	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1377892&r2=1377891&pathrev=1377892	Patch
73	http://svn.apache.org/viewvc?view=revision&revision=1377892
74	http://svn.apache.org/viewvc?view=revision&revision=1377892
75	http://tomcat.apache.org/security-6.html	Vendor Advisory
76	http://tomcat.apache.org/security-6.html	Vendor Advisory
77	http://tomcat.apache.org/security-7.html	Vendor Advisory
78	http://tomcat.apache.org/security-7.html	Vendor Advisory
79	http://www.securityfocus.com/bid/56812
80	http://www.securityfocus.com/bid/56812
81	http://www.securitytracker.com/id?1027833
82	http://www.securitytracker.com/id?1027833
83	http://www.ubuntu.com/usn/USN-1685-1
84	http://www.ubuntu.com/usn/USN-1685-1
85	https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878
86	https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878
87	https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878
88	https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878
89	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19305
90	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19305

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Apache Tomcat における security-constraint のチェックを回避される脆弱性

Title	Apache Tomcat における security-constraint のチェックを回避される脆弱性
Summary	Apache Tomcat の org/apache/catalina/realm/RealmBase.java には、FORM 認証が使用される際、security-constraint のチェックを回避される脆弱性が存在します。
Possible impacts	第三者により、setUserPrincipal コールを使い、その後で /j_security_check を URI の末尾に付けられることにより、security-constraint のチェックを回避される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 4, 2012, midnight
Registration Date	Dec. 20, 2012, 2:08 p.m.
Last Update	March 9, 2015, 2:23 p.m.

Affected System

ヒューレット・パッカード

HP Service Manager 9.30 (Windows/Linux/HP-UX/Solaris/AIX)

HP Service Manager 9.31 (Windows/Linux/HP-UX/Solaris/AIX)

HP XP P9000 Performance Advisor ソフトウェア 5.4.1 およびそれ以前

Apache Software Foundation

Apache Tomcat 6.0.36 未満の 6.x

Apache Tomcat 7.0.30 未満の 7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-3546	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3546
National Vulnerability Database (NVD)
2	CVE-2012-3546	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3546

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Apache Tomcat
1	security-6	http://tomcat.apache.org/security-6.html
2	security-7	http://tomcat.apache.org/security-7.html
Apache-SVN
3	Diff of /tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/realm/RealmBase.java?r1=1377892&r2=1377891&pathrev=1377892
4	Diff of /tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml	http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1377892&r2=1377891&pathrev=1377892
5	Revision 1377892	http://svn.apache.org/viewvc?view=revision&revision=1377892
HP Security Bulletin
6	HPSBMU02873 SSRT101182	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c03748878
7	HPSBST02955 SSRT101157	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04047415
Red Hat Security Advisory
8	RHSA-2013:0004	http://rhn.redhat.com/errata/RHSA-2013-0004.html
9	RHSA-2013:0005	http://rhn.redhat.com/errata/RHSA-2013-0005.html
10	RHSA-2013:0146	http://rhn.redhat.com/errata/RHSA-2013-0146.html
11	RHSA-2013:0147	http://rhn.redhat.com/errata/RHSA-2013-0147.html
12	RHSA-2013:0151	http://rhn.redhat.com/errata/RHSA-2013-0151.html
13	RHSA-2013:0157	http://rhn.redhat.com/errata/RHSA-2013-0157.html
14	RHSA-2013:0158	http://rhn.redhat.com/errata/RHSA-2013-0158.html
15	RHSA-2013:0162	http://rhn.redhat.com/errata/RHSA-2013-0162.html
16	RHSA-2013:0163	http://rhn.redhat.com/errata/RHSA-2013-0163.html
17	RHSA-2013:0164	http://rhn.redhat.com/errata/RHSA-2013-0164.html
18	RHSA-2013:0191	http://rhn.redhat.com/errata/RHSA-2013-0191.html
19	RHSA-2013:0192	http://rhn.redhat.com/errata/RHSA-2013-0192.html
20	RHSA-2013:0193	http://rhn.redhat.com/errata/RHSA-2013-0193.html
21	RHSA-2013:0194	http://rhn.redhat.com/errata/RHSA-2013-0194.html
22	RHSA-2013:0195	http://rhn.redhat.com/errata/RHSA-2013-0195.html
23	RHSA-2013:0196	http://rhn.redhat.com/errata/RHSA-2013-0196.html
24	RHSA-2013:0197	http://rhn.redhat.com/errata/RHSA-2013-0197.html
25	RHSA-2013:0198	http://rhn.redhat.com/errata/RHSA-2013-0198.html
26	RHSA-2013:0221	http://rhn.redhat.com/errata/RHSA-2013-0221.html
27	RHSA-2013:0235	http://rhn.redhat.com/errata/RHSA-2013-0235.html
28	RHSA-2013:0623	http://rhn.redhat.com/errata/RHSA-2013-0623.html
29	RHSA-2013:0640	http://rhn.redhat.com/errata/RHSA-2013-0640.html
30	RHSA-2013:0641	http://rhn.redhat.com/errata/RHSA-2013-0641.html
31	RHSA-2013:0642	http://rhn.redhat.com/errata/RHSA-2013-0642.html
SECURITY BLOG
32	Multiple vulnerabilities in Apache Tomcat	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_apache_tomcat3

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載 [2013年01月24日] ベンダ情報：レッドハット (RHSA-2013:0146) を追加ベンダ情報：レッドハット (RHSA-2013:0147) を追加 [2013年03月08日] ベンダ情報：オラクル (Multiple vulnerabilities in Apache Tomcat) を追加 [2015年03月09日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBMU02873 SSRT101182) を追加ベンダ情報：ヒューレット・パッカード (HPSBST02955 SSRT101157) を追加ベンダ情報：レッドハット (RHSA-2013:0004) を追加ベンダ情報：レッドハット (RHSA-2013:0005) を追加ベンダ情報：レッドハット (RHSA-2013:0151) を追加ベンダ情報：レッドハット (RHSA-2013:0157) を追加ベンダ情報：レッドハット (RHSA-2013:0158) を追加ベンダ情報：レッドハット (RHSA-2013:0162) を追加ベンダ情報：レッドハット (RHSA-2013:0163) を追加ベンダ情報：レッドハット (RHSA-2013:0164) を追加ベンダ情報：レッドハット (RHSA-2013:0191) を追加ベンダ情報：レッドハット (RHSA-2013:0192) を追加ベンダ情報：レッドハット (RHSA-2013:0193) を追加ベンダ情報：レッドハット (RHSA-2013:0194) を追加ベンダ情報：レッドハット (RHSA-2013:0195) を追加ベンダ情報：レッドハット (RHSA-2013:0196) を追加ベンダ情報：レッドハット (RHSA-2013:0197) を追加ベンダ情報：レッドハット (RHSA-2013:0198) を追加ベンダ情報：レッドハット (RHSA-2013:0221) を追加ベンダ情報：レッドハット (RHSA-2013:0235) を追加ベンダ情報：レッドハット (RHSA-2013:0623) を追加ベンダ情報：レッドハット (RHSA-2013:0640) を追加ベンダ情報：レッドハット (RHSA-2013:0641) を追加ベンダ情報：レッドハット (RHSA-2013:0642) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:beta::::::
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.31:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:6.0.17:::::::*
cpe:2.3:a:apache:tomcat:6.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:6.0.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*