CVE-2010-1157: Apache Tomcat authentication realm leaks server hostname or IP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

low priorityCVSS 2.0 score is 2.6 (LOW) and the flaw only exposes the server's hostname or IP, with no integrity or availability impact.

What it is

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 may include the server's hostname or IP address in the realm field of the WWW-Authenticate header when a resource protected by BASIC or DIGEST authentication is requested. This is an information exposure issue that reveals internal infrastructure details useful for reconnaissance.

Impact

A remote attacker learns the server's hostname or IP address, which can aid further targeted attacks or network mapping. No data modification or code execution is gained.

Attack surface

Reachable over the network by sending an HTTP request to a resource that requires BASIC or DIGEST authentication; no authentication is needed to trigger the response, and no user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged; EPSS is 0.52507 (98.9th percentile), indicating high predicted likelihood of exploitation activity despite the low severity.

What to do

• Upgrade to a Tomcat release that includes the fix referenced in the Apache Tomcat security pages for 5.5 and 6.0.
• If upgrade is not possible, apply the vendor patch revisions (r936540, r936541) or the distribution backport.
• Avoid exposing Tomcat management or authenticated resources directly to untrusted networks; restrict access by firewall or reverse proxy.
• Review authentication realm configuration to avoid embedding hostnames or IP addresses in realm names.

Detection

• Inspect HTTP responses for WWW-Authenticate headers whose realm field contains a hostname or IP address.
• Monitor web server logs for repeated requests to authenticated resources from unexpected sources.
• Use network monitoring to flag outbound responses that disclose internal hostnames or IPs in headers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.