Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

🗓️ 09 Feb 2022 23:03:53Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 114 Views

Exposure of Sensitive Information in Apache Tomcat due to HTTP/2 Protocol Violatio

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Apache Tomcat vulnerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2)	16 Dec 202017:45	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2020-13943)	4 May 202117:48	–	ibm
IBM Security Bulletins	Security Bulletin: App Connect Professional is affected by Apache Tomcat vulnerabilities.	20 Jan 202106:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Apache Tomcat Vulnerabilities Affect IBM Control Center	14 May 202121:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
Tenable Nessus	Apache Tomcat < 10.0.0-M8 Vulnerability	14 Apr 202100:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-011)	27 Sep 202300:00	–	nessus
Tenable Nessus	Debian DLA-2407-1 : tomcat8 security update	15 Oct 202000:00	–	nessus
Tenable Nessus	Debian DSA-4835-1 : tomcat9 - security update	25 Jan 202100:00	–	nessus

Vulners

Node

org.apache.tomcat tomcat-coyoteRange10.0.0-M1–10.0.0-M7maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-13943
lists	www.lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2020/10/msg00019.html
security	www.security.netapp.com/advisory/ntap-20201016-0007/
debian	www.debian.org/security/2021/dsa-4835
lists	www.lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
oracle	www.oracle.com/security-alerts/cpuApr2021.html
github	www.github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a84f3bb
github	www.github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b

27 Sep 2023 09:47Current

0.3Low risk

Vulners AI Score0.3

CVSS 24

CVSS 3.14.3

EPSS0.57286