CVE-2020-17527High· 7.5▾ MidnightPoC availableWhile investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 4.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
25%
1 GitHub repo (last check)
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
tomcat >= 8.5.1, <= 8.5.59tomcat >= 9.0.1, <= 9.0.35tomcat = 9.0.0tomcat = 9.0.35-3.39.1tomcat = 9.0.35-3.57.3tomcat = 9.0.36tomcat = 9.0.37tomcat = 9.0.38tomcat = 9.0.39tomcat = 10.0.0element_plug-inoncommand_system_manager >= 3.0.0, <= 3.1.3debian_linux = 9.0debian_linux = 10.0blockchain_platform < 21.1.2communications_cloud_native_core_binding_support_function = 1.10.0communications_cloud_native_core_policy = 1.14.0communications_instant_messaging_server = 10.0.1.5.0instantis_enterprisetrack = 17.1instantis_enterprisetrack = 17.2instantis_enterprisetrack = 17.3mysql_enterprise_monitor < 8.0.23sd-wan_edge = 9.0workload_manager = 18cworkload_manager = 19cUpgrade past the affected range:
blockchain_platform 21.1.2mysql_enterprise_monitor 8.0.23Connected by shared product, vendor, weakness, or advisory.
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2021-24122Medium· 5.9When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some con…
CVE-2020-13935High· 7.5The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104
CVE-2020-9484High· 7.0When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use…
CVE-2020-13943Medium· 4.3If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possibl…
CVE-2021-30640Medium· 6.5A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm