CVE-2008-4308

Published: Feb 26, 2009Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.

Affected (14)

Products: Apache: Tomcat

1 product

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 4.1.32
Apache Tomcat	Version 4.1.33
Apache Tomcat	Version 4.1.34
Apache Tomcat	Version 5.5.10
Apache Tomcat	Version 5.5.11
Apache Tomcat	Version 5.5.12
Apache Tomcat	Version 5.5.13
Apache Tomcat	Version 5.5.14
Apache Tomcat	Version 5.5.15
Apache Tomcat	Version 5.5.16
Apache Tomcat	Version 5.5.17
Apache Tomcat	Version 5.5.18
Apache Tomcat	Version 5.5.19
Apache Tomcat	Version 5.5.20

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (20)

http://jvn.jp/en/jp/JVN66905322/index.html

Source: secalert@redhat.com

http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html

Source: secalert@redhat.com

http://secunia.com/advisories/34057

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/archive/1/501250

Source: secalert@redhat.com

http://www.securityfocus.com/bid/33913

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0541

Source: secalert@redhat.com

Patch

https://issues.apache.org/bugzilla/show_bug.cgi?id=40771

Source: secalert@redhat.com

ExploitVendor Advisory

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

http://jvn.jp/en/jp/JVN66905322/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34057

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/archive/1/501250

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/33913

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0541

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://issues.apache.org/bugzilla/show_bug.cgi?id=40771

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.