7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.732 High
EPSS
Percentile
98.1%
Important: Request smuggling CVE-2023-45648
Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.
This was fixed with commit 59583245.
This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.
Affects: 9.0.0-M1 to 9.0.80
Important: Denial of Service CVE-2023-44487
Tomcat’s HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError.
This was fixed with commit 6d1a9fd6.
This issue was reported to the Tomcat Security Team on 14 September 2023. The issue was made public on 10 October 2023.
Affects: 9.0.0-M1 to 9.0.80
Important: Information Disclosure CVE-2023-42795
When recycling various internal objects, including the request and the response, prior to re-use by the next request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next.
This was fixed with commit 44d05d75.
This issue was identified by the Tomcat Security Team on 13 September 2023. The issue was made public on 10 October 2023.
Affects: 9.0.0-M1 to 9.0.80
Low: Denial of Service CVE-2023-42794
Tomcat’s internal fork of a Commons FileUpload included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.
This was fixed with commit 43b882b8.
This issue was reported to the Tomcat Security Team on 1 September 2023. The issue was made public on 10 October 2023.
Affects: 9.0.70 to 9.0.80
CPE | Name | Operator | Version |
---|---|---|---|
apache tomcat | ge | 9.0.0-M1 | |
apache tomcat | ge | 9.0.70 | |
apache tomcat | le | 9.0.80 |
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.732 High
EPSS
Percentile
98.1%