CVSS 4.8 · Medium EPSS 9,4%
Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada apache tomcat, debian linux +18 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut NVD.
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| apache | tomcat | Versi 7.0.0 hingga 7.0.99 |
| apache | tomcat | Versi 8.5.0 hingga 8.5.50 |
| apache | tomcat | Versi 9.0.0 hingga 9.0.30 |
| apache | tomcat | Versi 9.0.0 |
| apache | tomcat | Versi 9.0.0 milestone1 |
| apache | tomcat | Versi 9.0.0 milestone10 |
| apache | tomcat | Versi 9.0.0 milestone11 |
| apache | tomcat | Versi 9.0.0 milestone12 |
| apache | tomcat | Versi 9.0.0 milestone13 |
| apache | tomcat | Versi 9.0.0 milestone14 |
| apache | tomcat | Versi 9.0.0 milestone15 |
| apache | tomcat | Versi 9.0.0 milestone16 |
| apache | tomcat | Versi 9.0.0 milestone17 |
| apache | tomcat | Versi 9.0.0 milestone18 |
| apache | tomcat | Versi 9.0.0 milestone19 |
| apache | tomcat | Versi 9.0.0 milestone2 |
| apache | tomcat | Versi 9.0.0 milestone20 |
| apache | tomcat | Versi 9.0.0 milestone21 |
| apache | tomcat | Versi 9.0.0 milestone22 |
| apache | tomcat | Versi 9.0.0 milestone23 |
| apache | tomcat | Versi 9.0.0 milestone24 |
| apache | tomcat | Versi 9.0.0 milestone25 |
| apache | tomcat | Versi 9.0.0 milestone26 |
| apache | tomcat | Versi 9.0.0 milestone27 |
| apache | tomcat | Versi 9.0.0 milestone3 |
| apache | tomcat | Versi 9.0.0 milestone4 |
| apache | tomcat | Versi 9.0.0 milestone5 |
| apache | tomcat | Versi 9.0.0 milestone6 |
| apache | tomcat | Versi 9.0.0 milestone7 |
| apache | tomcat | Versi 9.0.0 milestone8 |
| apache | tomcat | Versi 9.0.0 milestone9 |
| debian | debian linux | Versi 8.0 |
| debian | debian linux | Versi 9.0 |
| debian | debian linux | Versi 10.0 |
| canonical | ubuntu linux | Versi 16.04 |
| opensuse | leap | Versi 15.1 |
| netapp | data availability services | Semua versi |
| netapp | oncommand system manager | Versi 3.0.0 hingga 3.1.3 |
| oracle | agile engineering data management | Versi 6.2.1.0 |
| oracle | agile product lifecycle management | Versi 9.3.3 |
| oracle | agile product lifecycle management | Versi 9.3.5 |
| oracle | agile product lifecycle management | Versi 9.3.6 |
| oracle | communications element manager | Versi 8.1.1 |
| oracle | communications element manager | Versi 8.2.0 |
| oracle | communications element manager | Versi 8.2.1 |
| oracle | communications instant messaging server | Versi 10.0.1.4.0 |
| oracle | health sciences empirica inspections | Versi 1.0.1.2 |
| oracle | health sciences empirica signal | Versi 7.3.3 |
| oracle | hospitality guest access | Versi 4.2.0 |
| oracle | hospitality guest access | Versi 4.2.1 |
| oracle | hyperion infrastructure technology | Versi 11.1.2.4 |
| oracle | instantis enterprisetrack | Versi 17.1 hingga 17.3 |
| oracle | mysql enterprise monitor | Versi 4.0.0 hingga 4.0.12 |
| oracle | mysql enterprise monitor | Versi 8.0.0 hingga 8.0.20 |
| oracle | retail order broker | Versi 15.0 |
| oracle | siebel ui framework | Semua versi hingga 20.5 |
| oracle | transportation management | Versi 6.3.7 |
| oracle | workload manager | Versi 12.2.0.1 |
| oracle | workload manager | Versi 18c |
| oracle | workload manager | Versi 19c |