CVE-2020-13935High· 7.5▾ MidnightPoC availableThe payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requ…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 17.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
87%
2 GitHub repos
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
tomcat >= 7.0.27, <= 7.0.104tomcat >= 8.5.0, <= 8.5.56tomcat >= 9.0.1, <= 9.0.36tomcat = 9.0.0tomcat = 10.0.0debian_linux = 9.0debian_linux = 10.0oncommand_system_manager >= 3.0.0, <= 3.1.3leap = 15.1leap = 15.2ubuntu_linux = 16.04ubuntu_linux = 20.04epolicy_orchestrator = 5.9.0epolicy_orchestrator = 5.9.1epolicy_orchestrator = 5.10.0agile_engineering_data_management = 6.2.1.0agile_product_lifecycle_management = 9.3.3agile_product_lifecycle_management = 9.3.5agile_product_lifecycle_management = 9.3.6blockchain_platform < 21.1.2commerce_guided_search = 11.3.2communications_cloud_native_core_policy = 1.14.0communications_instant_messaging_server = 10.0.1.5.0fmw_platform = 12.2.1.3.0fmw_platform = 12.2.1.4.0instantis_enterprisetrack = 17.1instantis_enterprisetrack = 17.2instantis_enterprisetrack = 17.3managed_file_transfer = 12.2.1.3.0managed_file_transfer = 12.2.1.4.0mysql_enterprise_monitor <= 8.0.21siebel_ui_framework <= 20.12workload_manager = 12.2.0.1workload_manager = 18cworkload_manager = 19cUpgrade past the affected range:
blockchain_platform 21.1.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-9484High· 7.0When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use…
CVE-2021-33037Medium· 5.3Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse pr…
CVE-2021-25329High· 7.0The fix for CVE-2020-9484 was incomplete
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2020-13934High· 7.5An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2
CVE-2019-17569Medium· 4.8The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression