Düşük
CVE-2013-4286: Tomcat: hatalı girdi doğrulama
Açıklama (NVD)
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Özet bilgiler
- Ürün
- Apache Tomcat
- EPSS
- %16,21 (yüzdelik 97)
- CWE
- CWE-20
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-tomcat | 7.0.0 | 7.0.0 | — |
| apache-tomcat | 7.0.0 | 7.0.0 | — |
| apache-tomcat | 7.0.1 | 7.0.1 | — |
| apache-tomcat | 7.0.2 | 7.0.2 | — |
| apache-tomcat | 7.0.2 | 7.0.2 | — |
| apache-tomcat | 7.0.3 | 7.0.3 | — |
| apache-tomcat | 7.0.4 | 7.0.4 | — |
| apache-tomcat | 7.0.4 | 7.0.4 | — |
| apache-tomcat | 7.0.10 | 7.0.10 | — |
| apache-tomcat | 7.0.11 | 7.0.11 | — |
| apache-tomcat | 7.0.12 | 7.0.12 | — |
| apache-tomcat | 7.0.13 | 7.0.13 | — |
| apache-tomcat | 7.0.14 | 7.0.14 | — |
| apache-tomcat | 7.0.15 | 7.0.15 | — |
| apache-tomcat | 7.0.16 | 7.0.16 | — |
| apache-tomcat | 7.0.17 | 7.0.17 | — |
| apache-tomcat | 7.0.18 | 7.0.18 | — |
| apache-tomcat | 7.0.19 | 7.0.19 | — |
| apache-tomcat | 7.0.20 | 7.0.20 | — |
| apache-tomcat | 7.0.21 | 7.0.21 | — |
| apache-tomcat | 7.0.22 | 7.0.22 | — |
| apache-tomcat | 7.0.23 | 7.0.23 | — |
| apache-tomcat | 7.0.24 | 7.0.24 | — |
| apache-tomcat | 7.0.25 | 7.0.25 | — |
| apache-tomcat | 7.0.26 | 7.0.26 | — |
| apache-tomcat | 7.0.27 | 7.0.27 | — |
| apache-tomcat | 7.0.28 | 7.0.28 | — |
| apache-tomcat | 7.0.29 | 7.0.29 | — |
| apache-tomcat | 7.0.30 | 7.0.30 | — |
| apache-tomcat | 7.0.31 | 7.0.31 | — |
Kaynaklar
- NVD kaydı
- advisories.mageia.org
- marc.info
- marc.info
- rhn.redhat.com
- rhn.redhat.com
- rhn.redhat.com
- seclists.org
- secunia.com
- secunia.com
- secunia.com
- secunia.com
- secunia.com
- secunia.com
- secunia.com
- svn.apache.org
- svn.apache.org
- svn.apache.org
- tomcat.apache.org
- tomcat.apache.org
- tomcat.apache.org
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- CWE-20