GitHub Advisoryadvisory · Maven

GHSA-fjwp-r6fm-q6qw Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request

HIGH Published 2022-05-14 Modified 2024-10-15 Official page ↗
Aliases
CVE-2016-8747
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-12-08

Affected packages

• Maven org.apache.tomcat:tomcat: >= 8.5.7, < 8.5.10 → fixed in 8.5.10 • Maven org.apache.tomcat:tomcat: >= 9.0.0.M11, < 9.0.0.M16 → fixed in 9.0.0.M16

Description

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

Related

Alias · CVE (1)

  • CVE-2016-8747 An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References