CVE-2005-3164
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request,…
Does this matter?
Lower severity and a low EPSS score (6.52%). Track it; it rarely justifies an emergency change on its own.
Description
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 6.52% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- hitachi/cosminexus application server · apache/tomcat
- Source
- cve@mitre.org
References
- http://jvn.jp/jp/JVN%2379314822/index.htmlVDB Entry
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/17019Broken Link, Vendor Advisory
- http://secunia.com/advisories/30802Broken Link, Vendor Advisory
- http://secunia.com/advisories/30899Broken Link, Vendor Advisory
- http://secunia.com/advisories/30908Broken Link, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1Broken Link
- http://support.apple.com/kb/HT2163Third Party Advisory
- http://tomcat.apache.org/security-4.htmlVendor Advisory
- http://www.hitachi-support.com/security_e/vuls_e/HS05-019_e/01-e.htmlThird Party Advisory
- http://www.securityfocus.com/bid/15003Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1979/referencesVendor Advisory
- http://www.vupen.com/english/advisories/2008/1981/referencesVendor Advisory
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
- http://jvn.jp/jp/JVN%2379314822/index.htmlVDB Entry
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/17019Broken Link, Vendor Advisory
- http://secunia.com/advisories/30802Broken Link, Vendor Advisory
- http://secunia.com/advisories/30899Broken Link, Vendor Advisory
- http://secunia.com/advisories/30908Broken Link, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1Broken Link
- http://support.apple.com/kb/HT2163Third Party Advisory
- http://tomcat.apache.org/security-4.htmlVendor Advisory
- http://www.hitachi-support.com/security_e/vuls_e/HS05-019_e/01-e.htmlThird Party Advisory
- http://www.securityfocus.com/bid/15003Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1979/referencesVendor Advisory
- http://www.vupen.com/english/advisories/2008/1981/referencesVendor Advisory
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.