Attacker Value
Unknown
CVE-2021-25122
CVE-2021-25122
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A’s request.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None
General Information
Vendors
- apache,
- debian,
- oracle
Products
- agile plm 9.3.3,
- agile plm 9.3.6,
- communications cloud native core policy 1.14.0,
- communications cloud native core security edge protection proxy 1.6.0,
- communications instant messaging server 10.0.1.5.0,
- database 12.2.0.1,
- database 19c,
- database 21c,
- debian linux 10.0,
- debian linux 9.0,
- graph server and client,
- graph server and client 21.3.0,
- instantis enterprisetrack 17.1,
- instantis enterprisetrack 17.2,
- instantis enterprisetrack 17.3,
- managed file transfer 12.2.1.3.0,
- managed file transfer 12.2.1.4.0,
- mysql enterprise monitor,
- siebel ui framework,
- tomcat,
- tomcat 10.0.0,
- tomcat 9.0.0
References
Advisory
