Lucene search

IBM4462074F797DC317C6FD938386025312060BE3B4C94DA71EFB2D27120DF6D38C

HistoryFeb 16, 2024 - 1:15 p.m.

Security Bulletin: Due to use of Apache Tomcat, App Connect Professional is vulnerable to HTTP request smuggling.

2024-02-1613:15:11

www.ibm.com

app connect professional

apache tomcat

http request smuggling

vulnerability

version 7.5.5.0

cve-2023-46589

fix

ibm

security advisory

7.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.9%

JSON

Summary

App Connect Professional has addressed the following vulnerability reported in Apache Tomcat. (CVE-2023-46589)

Vulnerability Details

CVEID:CVE-2023-46589
**DESCRIPTION:**Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP trailer headers. By sending a specially crafted HTTP(S) trailer header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/272444 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
App connect professional	7.5.5.0

Remediation/Fixes

App Connect Professional	7.5.5.0	LI83116	7550 Fixcentral link

Workarounds and Mitigations

None

CPENameOperatorVersion
app connect professionaleq755

CPE	Name	Operator	Version
	app connect professional	eq	755