IBM647071CC207FFBA42477C7587FD006F5563B5EA9AE13C730954E58FAC89C2C19Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.5%
Summary
App Connect Professional has addressed the following vulnerabilities reported in Apache Tomcat.
Vulnerability Details
CVEID:CVE-2023-42795
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an incomplete Cleanup vulnerability when recycling various internal objects. By skipping some parts of the recycling process, an attacker could exploit this vulnerability to obtain sensitive information leaking from the current request/response to the next.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268201 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| App connect professional | 7.5.5.0 |
Remediation/Fixes
| App Connect Professional | 7.5.5.0 | LI83103 | 7550 Fixcentral link |
|---|
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| app connect professional | eq | 755 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.3 Medium
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.5%