GoogleOSV:GHSA-F4QF-M5GF-8JM8Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
76.4%
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
References
packetstormsecurity.com/files/176951/Apache-Tomcat-8.5.63-9.0.43-HTTP-Response-Smuggling.html
www.openwall.com/lists/oss-security/2024/01/19/2
github.com/apache/tomcat
github.com/apache/tomcat/commit/86ccc43940861703c2be96a5f35384407522125a
github.com/apache/tomcat/commit/ce4b154e7b48f66bd98858626347747cd2514311
lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz
nvd.nist.gov/vuln/detail/CVE-2024-21733
security.netapp.com/advisory/ntap-20240216-0005
tomcat.apache.org/security-8.html
tomcat.apache.org/security-9.html
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
76.4%