Apache Tomcat AJP Connector Information Leak
Low severity
GitHub Reviewed
Published
May 1, 2022
to the GitHub Advisory Database
•
Updated Sep 18, 2023
Package
Affected versions
>= 4.0.1, <= 4.0.6
>= 4.1.0, <= 4.1.36
Patched versions
None
Description
Published by the National Vulnerability Database
Oct 6, 2005
Published to the GitHub Advisory Database
May 1, 2022
Reviewed
Sep 18, 2023
Last updated
Sep 18, 2023
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
References