CVE-2008-3271

2008-10-1320:00:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2008-3271

apache tomcat

ip address restriction bypass

sensitive information disclosure

thread safety

nvd

6 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

59.5%

JSON

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a “synchronization problem” and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

CPENameOperatorVersion
apache:tomcatapache tomcateq4.1.2
apache:tomcatapache tomcateq4.1.21
apache:tomcatapache tomcateq4.1.24
apache:tomcatapache tomcateq4.1.25
apache:tomcatapache tomcateq4.1.4
apache:tomcatapache tomcateq4.1.27
apache:tomcatapache tomcateq4.1.30
apache:tomcatapache tomcateq4.1.7
apache:tomcatapache tomcateq4.1.11
apache:tomcatapache tomcateq4.1.18

CPE	Name	Operator	Version
apache:tomcat	apache tomcat	eq	4.1.2
apache:tomcat	apache tomcat	eq	4.1.21
apache:tomcat	apache tomcat	eq	4.1.24
apache:tomcat	apache tomcat	eq	4.1.25
apache:tomcat	apache tomcat	eq	4.1.4
apache:tomcat	apache tomcat	eq	4.1.27
apache:tomcat	apache tomcat	eq	4.1.30
apache:tomcat	apache tomcat	eq	4.1.7
apache:tomcat	apache tomcat	eq	4.1.11
apache:tomcat	apache tomcat	eq	4.1.18