A critical authorization bypass vulnerability in Apache Tomcat allows unauthenticated attackers to circumvent security constraints, posing a significant risk to protected resources.

This is an incorrect authorization vulnerability (CWE-863) within the FORM authentication process. The flaw allows an unauthenticated attacker to bypass security constraints that were intended to restrict user access to resources based on the HTTP method used, specifically permitting unauthorized access to POST requests.

Successful exploitation of this vulnerability allows unauthorized access to sensitive application resources that were intended to be protected by security constraints. Given the CVSS score of 9.1, this is a critical security failure that could lead to unauthorized data disclosure or modification. Organizations relying on Tomcat for web application hosting face a high risk of compromise if their security posture relies on method-specific access controls.

Immediate Action: Upgrade to Apache Tomcat versions 11.0.25, 10.1.58, or 9.0.121 to implement the vendor-provided fix.

Proactive Monitoring: Review web server access logs for anomalous patterns where sensitive endpoints are accessed via unexpected HTTP methods.

Compensating Controls: Implement Web Application Firewall (WAF) rules to strictly enforce method-based access policies and block traffic that attempts to bypass configured security constraints.

Public Exploit Available: No

The severity of this vulnerability, combined with the ease of exploitation for unauthenticated attackers, necessitates immediate attention. IT teams should prioritize patching Apache Tomcat instances to the versions specified above. If immediate patching is not feasible, ensure that compensating controls, such as WAF rules or network-level access restrictions, are active to protect sensitive resources from unauthorized access.