CVE-2013-2071

Severity

3.7

Description

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2071

https://bz.apache.org/bugzilla/show_bug.cgi?id=54178#c10

http://tools.cisco.com/security/center/viewAlert.x?alertId=29283

Project

Apache Tomcat

Category

n/a

Tags

functional

Date Disclosed

2013-06-01

Date Discovered

2013-02-19

Apache Tomcat 7.0.x

First release:

2011-01-14

First release:

2021-03-31

CVEs:

55

Support Lifecycle:

Maintenance Support

Namespace:

javax

7.0.6 7.0.8 7.0.11 7.0.12 7.0.14 7.0.16 7.0.19 7.0.20 7.0.21 7.0.22 7.0.23 7.0.25 7.0.26 7.0.27 7.0.28 7.0.29 7.0.30 7.0.32 7.0.33 7.0.34 7.0.35 7.0.37 7.0.39

Apache TomEE 1.5.x

First release:

2012-09-28

CVEs:

119

Support Lifecycle:

Namespace:

javax

1.5.0 1.5.1 1.5.2

Apache TomEE 1.0.x

First release:

2012-04-27

CVEs:

130

Support Lifecycle:

Namespace:

javax

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.