Information disclosure in Apache Tomcat
CVE-2017-5647
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Vulnerability class: Information Disclosure
EPSS: 0.168 (96.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Tomcat — versions 6.0.0, 6.0.1, 6.0.2
- Apache Software Foundation Tomcat — versions 8.0.0.RC1 to 8.0.42, 6.0.0 to 6.0.52, 7.0.0 to 7.0.76
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, x_refsource_GENTOO)
- security@apache.org (x_refsource_CONFIRM)
- security@apache.org (x_refsource_REDHAT, vendor-advisory)
- security@apache.org (x_refsource_REDHAT, vendor-advisory)
- security@apache.org (vendor-advisory, x_refsource_DEBIAN)
- security@apache.org (x_refsource_CONFIRM)
- security@apache.org (x_refsource_REDHAT, vendor-advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (vdb-entry, x_refsource_SECTRACK)
- security@apache.org (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2017-5647?
- CVE-2017-5647 is a high-severity vulnerability in Apache Tomcat, classified under Information Disclosure. CVSS score: 7.5/10. Published 2017-04-17.
- How severe is CVE-2017-5647?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-5647 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.