CVE-2011-3375 — MEDIUM (5.0)

Vulnerability Description

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Apache	Tomcat	6.0.30

Related Weaknesses (CWE)

CWE-200

References

http://tomcat.apache.org/security-6.htmlVendor Advisory
http://tomcat.apache.org/security-7.htmlVendor Advisory
http://www.debian.org/security/2012/dsa-2401
http://tomcat.apache.org/security-6.htmlVendor Advisory
http://tomcat.apache.org/security-7.htmlVendor Advisory
http://www.debian.org/security/2012/dsa-2401

FAQ

What is CVE-2011-3375?

CVE-2011-3375 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintend...

How severe is CVE-2011-3375?

CVE-2011-3375 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2011-3375?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.