Information disclosure in Apache Tomcat
CVE-2021-25122
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.181 (97.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.181 · newest: 0.181 · change: 0.000
Affected products
- Apache Tomcat — versions 9.0.0, 10.0.0
- Apache Software Foundation Tomcat — versions Apache Tomcat 10, Apache Tomcat 9, Apache Tomcat 8.5
- Oracle Agile Plm — versions 9.3.3, 9.3.6
- Oracle Agile Product Lifecycle Management — versions 9.3.3, 9.3.6
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
- Oracle Communications Cloud Native Core Security Edge Protection Proxy — versions 1.6.0
- Oracle Communications Instant Messaging Server — versions 10.0.1.5.0
- Oracle Database — versions 12.2.0.1, 19c, 21c
- Oracle Graph Server And Client — versions 21.3.0
- Oracle Instantis Enterprisetrack — versions 17.1, 17.2, 17.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b… (Mailing List, Vendor Advisory)
- lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b… (mailing-list)
- lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b… (mailing-list)
- lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3b… (mailing-list)
- lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b… (mailing-list)
- www.openwall.com/lists/oss-security/2021/03/01/1 (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e… (mailing-list)
- lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edb… (mailing-list)
- lists.debian.org/debian-lts-announce/2021/03/msg00018.html (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2021/dsa-4891 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-25122?
- CVE-2021-25122 is a high-severity vulnerability in Apache Tomcat, classified under Information Disclosure. CVSS score: 7.5/10. Published 2021-03-01.
- How severe is CVE-2021-25122?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2021-25122 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.