Information Disclosure

2022-10-0308:39:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

60.7%

JSON

Apache Tomcat-Coyote is vulnerable to information disclosure. A remote unauthenticated attacker is able to cause client connections to share an Http11Processor instance resulting in responses or part responses to be received by a malicious client due to the simplified implementation of blocking reads and writes, disclosing sensitive information.

CPENameOperatorVersion
tomcat-coyoteeq9.0.0.M1
tomcat-coyotele10.1.0-M12
tomcat-coyotele10.0.18
tomcat-coyotele8.0.53
tomcat-coyotele8.5.77
tomcat-coyotele9.0.60
tomcat-coyotele7.0.2
tomcat-coyotele7.0.109
tomcat9:sideq9.0.40-1
tomcat-coyoteeq9.0.0.M1

Name	Operator	Version
tomcat-coyote	eq	9.0.0.M1
tomcat-coyote	le	10.1.0-M12
tomcat-coyote	le	10.0.18
tomcat-coyote	le	8.0.53
tomcat-coyote	le	8.5.77
tomcat-coyote	le	9.0.60
tomcat-coyote	le	7.0.2
tomcat-coyote	le	7.0.109
tomcat9:sid	eq	9.0.40-1
tomcat-coyote	eq	9.0.0.M1