This vulnerability arises from insufficient technical documentation in Apache Tomcat that failed to clearly specify the secure configuration requirements for the EncryptInterceptor component. This lack of clear documentation could lead to misconfiguration and potential security weaknesses. The affected versions span multiple major releases of Apache Tomcat, with fixes implemented in later versions as noted. There is no indication of known exploits in the wild or a CVSS score assigned. The vendor recommends upgrading to fixed versions to address the issue.

The impact is related to potential security risks stemming from misconfiguration due to unclear documentation for securely configuring the EncryptInterceptor. While no direct exploit or attack vector is described, insufficient documentation can lead to insecure deployments, potentially exposing sensitive data or weakening security controls. No known exploits have been reported.

Users should upgrade affected Apache Tomcat versions to 11.0.24, 10.1.57, or 9.0.120 or later, where the documentation and configuration issues have been addressed. Patch status is confirmed by the vendor's recommended upgrade versions. No other specific mitigations are indicated.