GitHub Advisoryadvisory · Maven

GHSA-7g59-hm8v-cwmc Apache Tomcat information disclosure vulnerability

LOW Published 2022-05-02 Modified 2024-02-09 Official page ↗
Aliases
CVE-2008-4308
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Low
Weaknesses
CWE-200
Reviewed
2024-02-09

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.1.32, < 4.1.35 → fixed in 4.1.35 • Maven org.apache.tomcat:tomcat: >= 5.5.10, < 5.5.21 → fixed in 5.5.21

Description

The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.

Related

Alias · CVE (1)

  • CVE-2008-4308 The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References