VulnerabilityModified
CVE-2011-3375
Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header…
MEDIUM 5.0EPSS 6.33%
Does this matter?
Lower severity and a low EPSS score (6.33%). Track it; it rarely justifies an emergency change on its own.
Description
Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 6.33% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apache/tomcat
- Source
- secalert@redhat.com
References
- http://tomcat.apache.org/security-6.htmlVendor Advisory
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://www.debian.org/security/2012/dsa-2401
- http://tomcat.apache.org/security-6.htmlVendor Advisory
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://www.debian.org/security/2012/dsa-2401
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.