Attacker Value
Unknown
CVE-2020-17527
CVE-2020-17527
(Last updated February 22, 2025) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None
General Information
Products
- blockchain platform,
- communications cloud native core binding support function 1.10.0,
- communications cloud native core policy 1.14.0,
- communications instant messaging server 10.0.1.5.0,
- debian linux 10.0,
- debian linux 9.0,
- element plug-in -,
- instantis enterprisetrack 17.1,
- instantis enterprisetrack 17.2,
- instantis enterprisetrack 17.3,
- mysql enterprise monitor,
- oncommand system manager,
- sd-wan edge 9.0,
- tomcat,
- tomcat 10.0.0,
- tomcat 9.0.0,
- tomcat 9.0.35-3.39.1,
- tomcat 9.0.35-3.57.3,
- tomcat 9.0.36,
- tomcat 9.0.37,
- tomcat 9.0.38,
- tomcat 9.0.39,
- workload manager 18c,
- workload manager 19c
Weaknesses
References
Advisory
Miscellaneous
