BIT-TOMCAT-2023-42795 Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

🗓️ 06 Mar 2024 11:08:01Reported by GoogleType

osv🔗 osv.dev👁 44 Views

Incomplete Cleanup vulnerability in Apache Tomcat from version 8.5.0 to 11.0.0-M11 allows information leaking. Upgrade to 8.5.94 onwards, 9.0.81 onwards, 10.1.14 onwards, or 11.0.0-M12 onwards

Reporter	Title	Published	Views	Family All 200
GithubExploit	Exploit for CVE-2020-1938	29 Nov 202508:31	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.25 addresses multiple vulnerabilities	24 Nov 202313:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Release 7.0.0 addresses multiple vulnerabilities.	4 Jan 202407:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management	22 Mar 202416:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to multiple Apache Tomcat vulnerabilities (CVE-2023-42794, CVE-2023-42795, CVE-2023-44487)	13 Dec 202321:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	7 Dec 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to multiple CVEs due to Apache Tomcat.	14 Nov 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: Datapower Operations Dashboard Multiple Vulnerabilities in Apache Tomcat	7 Feb 202416:12	–	ibm

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/10/10/9
lists	www.lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00020.html
security	www.security.netapp.com/advisory/ntap-20231103-0007/
debian	www.debian.org/security/2023/dsa-5521
debian	www.debian.org/security/2023/dsa-5522
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-42795

20 Mar 2026 12:15Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3

EPSS0.0216

SSVC