CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
98.4%
The version of Tomcat installed on the remote host is prior to 9.0.81. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.81_security-9 advisory.
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. (CVE-2023-45648)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
(CVE-2023-42795)
Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. (CVE-2023-42794)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(182809);
script_version("1.10");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/23");
script_cve_id(
"CVE-2023-42794",
"CVE-2023-42795",
"CVE-2023-44487",
"CVE-2023-45648"
);
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/10/31");
script_xref(name:"IAVA", value:"2023-A-0534-S");
script_xref(name:"CEA-ID", value:"CEA-2024-0004");
script_xref(name:"IAVB", value:"2023-B-0083-S");
script_name(english:"Apache Tomcat 9.0.0.M1 < 9.0.81 multiple vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 9.0.81. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.81_security-9 advisory.
- Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from
10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly
parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a
single request as multiple requests leading to the possibility of request smuggling when behind a reverse
proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or
8.5.94 onwards, which fix the issue. (CVE-2023-45648)
- The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)
- Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat
from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from
8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to
information leaking from the current request/response to the next. Users are recommended to upgrade to
version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
(CVE-2023-42795)
- Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with
Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress
refactoring that exposed a potential denial of service on Windows if a web application opened a stream for
an uploaded file but failed to close the stream. The file would never be deleted from disk creating the
possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade
to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. (CVE-2023-42794)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
# https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?285c784f");
# https://github.com/apache/tomcat/commit/6d1a9fd6642387969e4410b9989c85856b74917a
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ce3035d3");
# https://github.com/apache/tomcat/commit/44d05d75d696ca10ce251e4e370511e38f20ae75
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6e5b0c6b");
# https://github.com/apache/tomcat/commit/43b882b8a577684498ab9b8851aa0427216784f7
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?da979f13");
# https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?763fc1f5");
script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 9.0.81 or later.");
script_set_attribute(attribute:"agent", value:"all");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-45648");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"patch_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:9");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Web Servers");
script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin", "os_fingerprint.nasl");
script_require_keys("installed_sw/Apache Tomcat");
exit(0);
}
include('vcf_extras.inc');
vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');
var constraints = [
{ 'min_version' : '9.0.0.M1', 'max_version' : '9.0.80', 'fixed_version' : '9.0.81' }
];
vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
app_info:app_info,
constraints:constraints,
severity:SECURITY_WARNING
);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42794
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42795
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45648
www.nessus.org/u?285c784f
www.nessus.org/u?6e5b0c6b
www.nessus.org/u?763fc1f5
www.nessus.org/u?ce3035d3
www.nessus.org/u?da979f13
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
98.4%