PRIOn knowledge basePRION:CVE-2008-3271Cross site request forgery (csrf)
6.2 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
59.2%
Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a โsynchronization problemโ and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
References
jvn.jp/en/jp/JVN30732239/index.html
jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html
lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
secunia.com/advisories/32213
secunia.com/advisories/32234
secunia.com/advisories/32398
secunia.com/advisories/35684
securityreason.com/securityalert/4396
tomcat.apache.org/security-4.html
tomcat.apache.org/security-5.html
www.fujitsu.com/global/support/software/security/products-f/interstage-200806e.html
www.nec.co.jp/security-info/secinfo/nv09-006.html
www.securityfocus.com/archive/1/497220/100/0/threaded
www.securityfocus.com/bid/31698
www.securitytracker.com/id?1021039
www.vupen.com/english/advisories/2008/2793
www.vupen.com/english/advisories/2008/2800
www.vupen.com/english/advisories/2009/1818
exchange.xforce.ibmcloud.com/vulnerabilities/45791
issues.apache.org/bugzilla/show_bug.cgi?id=25835
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
Related
6.2 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
59.2%