PT-2009-1236 · Apache · Apache Tomcat
Publicado
2009-02-26
·
Atualizado
2023-02-13
·
CVE-2008-4308
CVSS v2.0
2.6
Baixa
| Vetor | AV:N/AC:H/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 4.1.32 through 4.1.34
Apache Tomcat versions 5.5.10 through 5.5.20
Description
The issue is related to the
doRead method, which fails to return a -1 when a certain error condition occurs. This can cause Tomcat to send POST content from one request to a different request, potentially leading to the disclosure of sensitive information. For the issue to exist, the content read from the input stream must be disclosed before an ArrayIndexOutOfBoundsException occurs, which halts the processing of the request.Recommendations
For Apache Tomcat versions 4.1.32 through 4.1.34, update to a version outside of this range to resolve the issue.
For Apache Tomcat versions 5.5.10 through 5.5.20, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to sensitive information and ensuring that POST content is properly handled to minimize the risk of exploitation.
Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Tomcat