Detections
Analytics

Apache TomCat mod_jk < 1.2.27 Cross-user Information Disclosure

low Log Correlation Engine Plugin ID 800629

Synopsis

The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files or data.

Description

mod_jk is reported vulnerable to an information disclosure flaw due to the way that it processes 'Content-Length' headers. Allegedly, an attacker supplying a NULL content-length can view the HTTP responses of other requests. An attacker exploiting this flaw would be able to possibly gain access to confidential data.

Solution

Upgrade to version 1.2.27 or higher.

See Also

tomcat.apache.org/download-connectors.cgi

Plugin Details

Severity: Low

ID: 800629

Family: Web Servers

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Reference Information

CVE: CVE-2008-5519

BID: 34412