NetSight
IP …
high7.5

CVE-2021-25122

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Impact

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat.embed:tomcat-embed-core>= 8.5.0, < 8.5.638.5.63
mavenorg.apache.tomcat:tomcat-coyote>= 10.0.0-M1, < 10.0.210.0.2

Affected products

VendorProductAffected versions
ApacheTomcat
from 8.5.0 through 8.5.61
from 9.0.0 through 9.0.41
Versions 9.0.0, 10.0.0
DebianDebian Linux
Versions 9.0, 10.0
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.6
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Cloud Native Core Security Edge Protection Proxy
Version 1.6.0
OracleCommunications Instant Messaging Server
Version 10.0.1.5.0
OracleDatabase
Versions 12.2.0.1, 19c, 21c
OracleGraph Server And Client
before 21.3.0
Version 21.3.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleManaged File Transfer
Versions 12.2.1.3.0, 12.2.1.4.0
OracleMysql Enterprise Monitor
through 8.0.23
OracleSiebel Ui Framework
through 21.9

Weakness classification

CWE-200

References