PT-2009-1236 · Apache · Apache Tomcat
Published
2009-02-26
·
Updated
2023-02-13
·
CVE-2008-4308
CVSS v2.0
2.6
Low
| Vector | AV:N/AC:H/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 4.1.32 through 4.1.34
Apache Tomcat versions 5.5.10 through 5.5.20
Description
The issue is related to the
doRead method, which fails to return a -1 when a certain error condition occurs. This can cause Tomcat to send POST content from one request to a different request, potentially leading to the disclosure of sensitive information. For the issue to exist, the content read from the input stream must be disclosed before an ArrayIndexOutOfBoundsException occurs, which halts the processing of the request.Recommendations
For Apache Tomcat versions 4.1.32 through 4.1.34, update to a version outside of this range to resolve the issue.
For Apache Tomcat versions 5.5.10 through 5.5.20, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to sensitive information and ensuring that POST content is properly handled to minimize the risk of exploitation.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Tomcat