CVE-2024-21733

CVE-2024-21733-POC Notes: 1. tomcat English environment 2. Specific constructed backend code, as shown in ROOT/vulnerable.jsp 3. If needed, modify the server address and port in the script. Default 127.0.0.1:8080 4. Timeout trigger, default 20 seconds, usually less than this time Process: 1...

Linux Distros Unpatched Vulnerability : CVE-2024-21733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from...

RHEL 9 : pki-servlet-engine (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - tomcat: Leaking of unrelated request bodies in default error page CVE-2024-21733 Note that Nessus has not tested fo...

Important: Red Hat Security Advisory: Red Hat Fuse 7.13.0 release and security update

Red Hat Fuse 7.13.0 release is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

SUSE: Security Advisory (SUSE-SU-2024:0829-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel security update

Red Hat build of Apache Camel 4.4.0 for Spring Boot release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Apache Tomcat 8.5.0 < 8.5.64 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.64. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.64security-8 advisory. - Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate...

Apache Tomcat 9.0.0.M1 < 9.0.44 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.44. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.44security-9 advisory. - Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate...

Security Bulletin: IBM DevOps Release 7.0.0.1 addresses multiple vulnerabilities.

Summary IBM DevOps Release 7.0.0.1 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2024-21733 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the leaking of unrelated request bodies in default error page. By sending a special...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2024:0829-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0829-1 advisory. - CVE-2024-21733: Fixed leaking of unrelated request bodies in default error page bsc1219023, bsc1220503. Tenable has extracted the precedin...

SUSE-SU-2024:0829-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2024-21733: Fixed leaking of unrelated request bodies in default error page bsc1219023, bsc1220503...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-011)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2024-011 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5...

Apache Tomcat 8.5.63 / 9.0.43 HTTP Response Smuggling

Exploit Title: CVE-2024-21733 Apache Tomcat HTTP Request Smuggling Date: 1/31/2024 Exploit Author: xer0dayz Vendor Homepage: https://tomcat.apache.org/ Software Link: https://tomcat.apache.org/ Version: 8.5.7 to 8.5.63 or 9.0.44 or later CVE : CVE-2024-21733 Description: Apache Tomcat from 8.5.7...

Apache Tomcat 8.5.63 / 9.0.43 HTTP Response Smuggling Vulnerability

Apache Tomcat suffers from a client-side de-sync vulnerability via HTTP request smuggling. Apache Tomcat versions 8.5.7 through 8.5.63 and 9.0.0-M11 through 9.0.43 are vulnerable. Exploit Title: CVE-2024-21733 Apache Tomcat HTTP Request Smuggling Date: 1/31/2024 Exploit Author: xer0dayz Vendor...

Internet Bug Bounty: CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)

SECURITY CVE-2024-21733 Apache Tomcat - Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0-M11 to 9.0.43 Apache Tomcat 8.5.7 to 8.5.63 Description: Incomplete POST requests triggered an error response that could contain data fr...

CVE-2024-21733

An information disclosure vulnerability was found in Apache Tomcat. Incomplete POST requests triggered an error response that could contain data from a previous HTTP request. This flaw allows a remote attacker to access files from another user that should be otherwise prevented by limits or...

com.aol.microservices:micro-tomcat (>=0.85, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.85, <=0.91.11) +6 more potentially affected by CVE-2024-21733 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m6)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aol.microservices:micro-tomcat =0.85, =0.85, =1.0.0, =1.0.0, =1.0.1 -...

org.apache.tomcat:tomcat-catalina (9.0.0.m1), org.apache.tomcat:tomcat-catalina-ha (9.0.0.m1) +3 more potentially affected by CVE-2024-21733 via org.apache.tomcat:tomcat-coyote (9.0.0.m1)

org.apache.tomcat:tomcat-coyote MAVEN version 9.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - org.apache.tomcat:tomcat-catalina 9.0.0.m1 - org.apache.tomcat:tomcat-catalina-ha 9.0.0.m1 -...

org.apache.tomcat:tomcat-catalina (9.0.0.m8), org.apache.tomcat:tomcat-catalina-ha (9.0.0.m8) +3 more potentially affected by CVE-2024-21733 via org.apache.tomcat:tomcat-coyote (9.0.0.m8)

org.apache.tomcat:tomcat-coyote MAVEN version 9.0.0.m8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - org.apache.tomcat:tomcat-catalina 9.0.0.m8 - org.apache.tomcat:tomcat-catalina-ha 9.0.0.m8 -...

org.apache.tomcat:tomcat-catalina (9.0.0.m9), org.apache.tomcat:tomcat-catalina-ha (9.0.0.m9) +3 more potentially affected by CVE-2024-21733 via org.apache.tomcat:tomcat-coyote (9.0.0.m9)

org.apache.tomcat:tomcat-coyote MAVEN version 9.0.0.m9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - org.apache.tomcat:tomcat-catalina 9.0.0.m9 - org.apache.tomcat:tomcat-catalina-ha 9.0.0.m9 -...