Information disclosure in Apache Tomcat
CVE-2017-5647
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.168 (97.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.168 · newest: 0.168 · change: 0.000
Affected products
- Apache Tomcat — versions 6.0.0, 6.0.1, 6.0.2
- Apache Software Foundation Tomcat — versions 8.0.0.RC1 to 8.0.42, 6.0.0 to 6.0.52, 7.0.0 to 7.0.76
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.gentoo.org/glsa/201705-09 (vendor-advisory)
- security.netapp.com/advisory/ntap-20180614-0001/
- access.redhat.com/errata/RHSA-2017:3080 (vendor-advisory)
- access.redhat.com/errata/RHSA-2017:1801 (vendor-advisory)
- www.debian.org/security/2017/dsa-3843 (vendor-advisory)
- www.arubanetworks.com/assets/alert/HPESBHF03730.txt
- access.redhat.com/errata/RHSA-2017:2494 (vendor-advisory)
- lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba481… (mailing-list)
- www.securitytracker.com/id/1038218 (vdb-entry)
- www.debian.org/security/2017/dsa-3842 (vendor-advisory)
Frequently asked questions
- What is CVE-2017-5647?
- CVE-2017-5647 is a high-severity vulnerability in Apache Tomcat, classified under Information Disclosure. CVSS score: 7.5/10. Published 2017-04-17.
- How severe is CVE-2017-5647?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-5647 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.