CVE-2023-34981

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Incorrect Permission Assignment for Critical Resource pada apache tomcat. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Rincian

Terbit di NVD

21 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz mailing list · advisory vendor
• https://security.netapp.com/advisory/ntap-20230714-0003/ advisory pihak ketiga