CVE-2023-46589High· 7.5▾ TwilightApache Tomcat Improper Input Validation vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
2.7%
Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.0-M11org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.16org.apache.tomcat:tomcat-catalina >= 9.0.0-M1, < 9.0.83org.apache.tomcat:tomcat-catalina >= 8.5.0, < 8.5.96org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.0-M11org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.16org.apache.tomcat.embed:tomcat-embed-core >= 9.0.0-M1, < 9.0.83org.apache.tomcat.embed:tomcat-embed-core >= 8.5.0, < 8.5.96org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.0-M11Upgrade to a patched release:
org.apache.tomcat:tomcat-catalina 11.0.0-M11org.apache.tomcat:tomcat-catalina 10.1.16org.apache.tomcat:tomcat-catalina 9.0.83org.apache.tomcat:tomcat-catalina 8.5.96org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M11org.apache.tomcat.embed:tomcat-embed-core 10.1.16org.apache.tomcat.embed:tomcat-embed-core 9.0.83org.apache.tomcat.embed:tomcat-embed-core 8.5.96org.apache.tomcat:tomcat-coyote 11.0.0-M11Connected by shared product, vendor, weakness, or advisory.
CVE-2016-1182High· 8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, …
CVE-2014-0114High· 7.5Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote at…
CVE-2013-4286Medium· 5.8Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incor…
CVE-2013-4322Medium· 4.3Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a …
CVE-2012-3544Medium· 5.0Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
CVE-2020-11987High· 8.2Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel