CVSS 5.3 · Medium EPSS 74,7%
Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada apache tomcat, apache tomee +20 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| apache | tomcat | Versi 8.5.0 hingga 8.5.66 |
| apache | tomcat | Versi sesudah 9.0.0 hingga 9.0.46 |
| apache | tomcat | Versi sesudah 10.0.0 hingga 10.0.6 |
| apache | tomee | Versi 8.0.6 |
| debian | debian linux | Versi 9.0 |
| debian | debian linux | Versi 10.0 |
| oracle | agile product lifecycle management | Versi 9.3.6 |
| oracle | communications cloud native core policy | Versi 1.14.0 |
| oracle | communications cloud native core service communication proxy | Versi 1.14.0 |
| oracle | communications diameter signaling router | Versi 8.0.0.0 hingga 8.5.0.2 |
| oracle | communications instant messaging server | Versi 10.0.1.5.0 |
| oracle | communications policy management | Versi 12.5.0 |
| oracle | communications pricing design center | Versi 12.0.0.3.0 |
| oracle | communications session report manager | Versi 8.0.0 hingga 8.2.4.0 |
| oracle | communications session route manager | Versi 8.0.0 hingga 8.2.4 |
| oracle | graph server and client | Semua versi sebelum 21.4 |
| oracle | healthcare translational research | Versi 4.1.0 |
| oracle | hospitality cruise shipboard property management system | Versi 20.1.0 |
| oracle | instantis enterprisetrack | Versi 17.1 |
| oracle | instantis enterprisetrack | Versi 17.2 |
| oracle | instantis enterprisetrack | Versi 17.3 |
| oracle | managed file transfer | Versi 12.2.1.3.0 |
| oracle | managed file transfer | Versi 12.2.1.4.0 |
| oracle | mysql enterprise monitor | Semua versi hingga 8.0.25 |
| oracle | sd-wan edge | Versi 9.0 |
| oracle | sd-wan edge | Versi 9.1 |
| oracle | secure global desktop | Versi 5.6 |
| oracle | utilities testing accelerator | Versi 6.0.0.1.1 |
| oracle | utilities testing accelerator | Versi 6.0.0.2.2 |
| oracle | utilities testing accelerator | Versi 6.0.0.3.1 |
| mcafee | epolicy orchestrator | Semua versi sebelum 5.10.0 |
| mcafee | epolicy orchestrator | Versi 5.10.0 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_1 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_10 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_2 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_3 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_4 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_5 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_6 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_7 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_8 |
| mcafee | epolicy orchestrator | Versi 5.10.0 update_9 |