CVE-2021-25122

CWE-200 — Information Exposure15 documents9 sources
Severity
7.5HIGH
EPSS
2.6%
top 14.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Apache Software Foundation Apache TomcatOracle Graph Server AND ClientApache Tomcat+10 more
Timeline
PublishedMar 1
Latest updateAug 1

Description

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages15 packages

▶CVEListV5apache_software_foundation/apache_tomcatApache Tomcat 10 — 10.0.2+2
▶NVDapache/tomcat8.5.0 — 8.5.61+3
▶Debiantomcat9< 9.0.43-1+3
▶Ubuntutomcat9< 9.0.16-3ubuntu0.18.04.2+1

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

6
OSV
tomcat8, tomcat9 vulnerabilities↗2024-08-01
▶
OSV
tomcat9 vulnerabilities↗2022-03-31
▶
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat↗2021-06-16
▶
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat↗2021-06-16
▶
CVEList
Apache Tomcat h2c request mix-up↗2021-03-01
▶

📋Vendor Advisories

8
Ubuntu
Tomcat vulnerabilities↗2024-08-01
▶
Ubuntu
Tomcat vulnerabilities↗2022-03-31
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: DBPlugin (Apache Tomcat) — CVE-2021-25122↗2022-01-15
▶
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Database Enterprise Edition (Apache Tomcat) — CVE-2021-25122↗2021-10-15
▶
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: HTTP Server (Apache Tomcat) — CVE-2021-25122↗2021-07-15
▶
CVE-2021-25122 (HIGH CVSS 7.5) | When responding to new h2c connecti | cvebase.io