CVE-2011-2204: Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is...

Security readout for executives and security teams

Certain older Apache Tomcat versions could write user passwords into logs when JMX user creation failed and MemoryUserDatabase was in use. A person with local access to those logs could recover credentials. The issue is mainly a credential-exposure risk on legacy systems, not evidence of remote code execution. Exposure is most likely in legacy Tomcat deployments using MemoryUserDatabase with JMX user administration and permissive log access. Modern or upgraded Tomcat installations should not be assumed affected without version and configuration validation. Treat this as a legacy credential-leak issue. Prioritize internet-facing, shared-hosting, or multi-user servers first, especially where local users or support accounts can read Tomcat logs. Mitigation focus: Upgrade Tomcat to 5.5.34, 6.0.33, 7.0.17, or later as applicable.; Review OS vendor advisories for packaged Tomcat fixes and backports.; Restrict Tomcat log access to only required service and admin accounts..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.