CVE-2011-2204
Insertion of Sensitive Information into Log File in Apache Tomcat
1.9 LowFix available
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
Exploit likelihood
0.67%Down 2.4 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
- Record
CVE-2011-2204- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
- Record
CVE-2011-2204- Updated
- 2026-11-02
EUVDEUVD-2022-3512 No score
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
- Record
EUVD-2022-3512- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c57p-3v2g-w9rg No score
Insertion of Sensitive Information into Log File in Apache Tomcat
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
- Record
GHSA-c57p-3v2g-w9rg- Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
OSVGHSA-c57p-3v2g-w9rg No score
Insertion of Sensitive Information into Log File in Apache Tomcat
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
- Record
GHSA-c57p-3v2g-w9rg- Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.34 | 5.5.34 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.33 | 6.0.33 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.19 | 7.0.19 |
tomcat6Debian:6.0 |
before 6.0.35-1+squeeze2, plus listed versions 6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2 Show 7 moreShow less6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-1 |
6.0.35-1+squeeze2 |
tomcat6Red Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-libRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat6-docs-webappRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-javadocRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-webappsRed Hat:enterprise_linux:6::server |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat5Red Hat:enterprise_linux:5::client |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5Red Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5Red Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-common-libRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jasperRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-server-libRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5-webappsRed Hat:enterprise_linux:5::server |
before 0:5.5.23-0jpp.22.el5_7 | 0:5.5.23-0jpp.22.el5_7 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el5 |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el6 |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2204 is a low vulnerability (CVSS 1.9) in Apache Tomcat, published June 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.apache.tomcat:tomcat 5.5.34.
References
mandriva.com/security/advisories?name=MDVSA-2011:156
debian.org/security/2012/dsa-2401
secunia.com/advisories/48308
support.apple.com/kb/HT5130
marc.info?l=bugtraq&m=136485229118404&w=2
redhat.com/support/errata/RHSA-2011-1845.html
Show 86 moreShow less
tomcat.apache.org/security-7.html
lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
exchange.xforce.ibmcloud.com/vulnerabilities/68238
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19532
securitytracker.com/id?1025712
bugzilla.redhat.com/show_bug.cgi?id=717013
osvdb.org/73429
securityfocus.com/bid/48456
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-2204
github.com/apache/tomcat/commit/763a56b45999653ce648a18462b8a826809215b1
access.redhat.com/errata/RHSA-2011:1845
web.archive.org/web/20110711083618/http://securitytracker.com/id?1025712
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1780.json
cve.org/CVERecord?id=CVE-2011-1184
issues.jboss.org/browse/JBPAPP-4873