SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2020-13935

Multiple requests with invalid payload lengths could lead to a denial of service.

HIGH 7.5EPSS 86.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 86.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CVSS 3.1
7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
86.61% probability · 100th percentile
CISA KEV
Not listed
Weakness
CWE-835
Affected
apache/tomcat · debian/debian linux · netapp/oncommand system manager · opensuse/leap · canonical/ubuntu linux · mcafee/epolicy orchestrator · oracle/agile engineering data management · oracle/agile product lifecycle management · oracle/blockchain platform · oracle/commerce guided search · oracle/communications cloud native core policy · oracle/communications instant messaging server · oracle/fmw platform · oracle/instantis enterprisetrack · oracle/managed file transfer · oracle/mysql enterprise monitor · oracle/siebel ui framework · oracle/workload manager
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.