CVE-2011-3375

Description

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

CVSS Metrics

• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 2.02%• Percentile: 84%

Techniques & Countermeasures

• CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

• Unknown•Tomcat

  6.0.30 | 6.0.31 | 6.0.32 | 6.0.33 | 7.0.0 | 7.0.1 | 7.0.2 | 7.0.3 | 7.0.4 | 7.0.5 | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.13 | 7.0.14 | 7.0.15 | 7.0.16 | 7.0.17 | 7.0.18 | 7.0.19 | 7.0.20 | 7.0.21

• org.apache.tomcat•tomcat

  ≥ 6.0.30, < 6.0.35 | ≥ 7.0, < 7.0.22

References (6)

• http://www.debian.org/security/2012/dsa-2401
• http://tomcat.apache.org/security-7.html
• http://tomcat.apache.org/security-6.html
• https://nvd.nist.gov/vuln/detail/CVE-2011-3375
• https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21
• https://github.com/apache/tomcat