CVEvulnerability

CVE-2008-3271

4.3 MEDIUM Published 2008-10-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-10-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-264

Description

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Affected configurations

• apache tomcat 4.1.0 • apache tomcat 4.1.1 • apache tomcat 4.1.2 • apache tomcat 4.1.3 • apache tomcat 4.1.4 • apache tomcat 4.1.5 • apache tomcat 4.1.6 • apache tomcat 4.1.7 • apache tomcat 4.1.8 • apache tomcat 4.1.9 • apache tomcat 4.1.10 • apache tomcat 4.1.11 • apache tomcat 4.1.12 • apache tomcat 4.1.13 • apache tomcat 4.1.14 • apache tomcat 4.1.15 • apache tomcat 4.1.16 • apache tomcat 4.1.17 • apache tomcat 4.1.18 • apache tomcat 4.1.19 • apache tomcat 4.1.20 • apache tomcat 4.1.21 • apache tomcat 4.1.22 • apache tomcat 4.1.23 • apache tomcat 4.1.24 • apache tomcat 4.1.25 • apache tomcat 4.1.26 • apache tomcat 4.1.27 • apache tomcat 4.1.28 • apache tomcat 4.1.29 • apache tomcat 4.1.30 • apache tomcat 4.1.31 • apache tomcat 5.5.0

Related

Weakness · not in database (1)

References