Request Smuggling

🗓️ 12 Oct 2023 11:56:46Reported by Veracode Vulnerability DatabaseType

Request Smuggling in Tomcat-Coyote vulnerability behind reverse proxy

Reporter	Title	Published	Views	Family All 181
GithubExploit	Exploit for CVE-2020-1938	29 Nov 202508:31	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Apache Tomcat	21 Apr 202617:20	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.25 addresses multiple vulnerabilities	24 Nov 202313:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Release 7.0.0 addresses multiple vulnerabilities.	4 Jan 202407:16	–	ibm
IBM Security Bulletins	Security Bulletin: due to the use of Apache Tomcat, IBM webMethods developer portal is affected by Multiple Vulnerabilities	30 Sep 202510:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	7 Dec 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: [All] Apache Tomcat (core only) - CVE-2023-45648 (Publicly disclosed vulnerability)	16 Jan 202407:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to multiple CVEs due to Apache Tomcat.	14 Nov 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm

Vulners

Node

AND

tomcat9 tomcat9Match9.0.40-1debian

AND

tomcat9 tomcat9Match9.0.43-1debian

AND

tomcat9 tomcat9Match9.0.31-1~deb10u3debian

tomcat9 tomcat9Match9.0.31-1~deb10u2debian

tomcat9 tomcat9Match9.0.31-1~deb10u4debian

tomcat9 tomcat9Match9.0.31-1~deb10u5debian

apache tomcat-coyoteRange7.0.0–8.5.93java

apache tomcat-coyoteRange9.0.0.M1–9.0.80java

apache tomcat-coyoteRange10.0.0-M1–10.1.13java

apache tomcat-coyoteRange11.0.0-M1–11.0.0-M11java

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/10/10/10
github	www.github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4
github	www.github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6
github	www.github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6
github	www.github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0
github	www.github.com/advisories/GHSA-r6j3-px5g-cq3x
lists	www.lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00020.html
security	www.security.netapp.com/advisory/ntap-20231103-0007/
debian	www.debian.org/security/2023/dsa-5521

13 Feb 2025 19:32Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3

EPSS0.05848

SSVC