tomcat: Leaking of unrelated request bodies in default error page

🗓️ 06 May 2024 14:10:14Reported by RedHatType

Apache Tomcat information disclosure: incomplete post requests leak data from previous requests in the default error page.

Reporter	Title	Published	Views	Family All 95
0day.today	Apache Tomcat 8.5.63 / 9.0.43 HTTP Response Smuggling Vulnerability	1 Feb 202400:00	–	zdt
GithubExploit	Exploit for Generation of Error Message Containing Sensitive Information in Apache Tomcat	15 Aug 202409:47	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM DevOps Release 7.0.0.1 addresses multiple vulnerabilities.	27 Mar 202417:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Build 7.0.0.1 addresses multiple vulnerabilities.	27 Mar 202417:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products (CVE-2023-45648, CVE-2023-42795, CVE-2023-46589, CVE-2024-21733)	30 Apr 202416:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.	2 Apr 202413:12	–	ibm
Tenable Nessus	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-017)	6 Feb 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-011)	6 Feb 202400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : tomcat8 (ALAS-2021-1547)	5 Nov 202100:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-21733
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-21733
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2024/01/19/2

10 Jul 2026 16:53Current

7.3High risk

Vulners AI Score7.3

CVSS 3.15.3

EPSS0.14286

SSVC