GitHub Advisoryadvisory · Maven

GHSA-qhqv-q4xg-f6g7 Apache Tomcat AJP Connector Information Leak

LOW Published 2022-05-01 Modified 2023-09-18 Official page ↗
Aliases
CVE-2005-3164
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Low
Weaknesses
CWE-200
Reviewed
2023-09-18

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.0.1, <= 4.0.6 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 4.1.0, <= 4.1.36 (no fix yet)

Description

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Related

Alias · CVE (1)

  • CVE-2005-3164 The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References