Home

CVE-2013-4286

Description

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a requests length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a Transfer-Encoding: chunked header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

Risk Information

Base Score
4.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score
Exploitation Probability
27.071

Associated Vulnerability

VulnerabilityOS Platform
Update Tomcat to 9.5.14Windows
Update Tomcat to 9.5.5Windows
Update Tomcat to 9.5.7Windows
Update Tomcat to 9.5.8Windows
Update Tomcat to 9.6.10Windows
Update Tomcat to 9.6.3Windows
Update Tomcat to 9.6.4Windows
Update Tomcat to 9.6.7Windows
Update Tomcat to 9.6.8Windows
Update Tomcat to 2.4.5Windows
Update Tomcat to 3.0.14Windows
Multiple Vulnerabilities are affected in IBM UrbanCode Deploy 6.0Windows
Vulnerabilities CVE-2013-4286 are affected in Oracle BI Publisher 5.8Windows
Vulnerabilities CVE-2013-4286,CVE-2013-4322,CVE-2013-4590 are fixed in Apache - tomcat 6.0.39Windows
Vulnerabilities CVE-2013-4286 are fixed in Apache - tomcat 7.0.47Windows
Vulnerabilities CVE-2013-4286 are fixed in Apache - tomcat 8.0.0Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.3Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4Windows
Multiple Vulnerabilities are affected in IBM Tivoli Application Dependency Discovery Manager 7.3.0.9Windows
Update Tomcat to 9.5.14 (For Linux)Linux
Update Tomcat to 9.5.5 (For Linux)Linux
Update Tomcat to 9.5.7 (For Linux)Linux
Update Tomcat to 9.5.8 (For Linux)Linux
Update Tomcat to 9.6.10 (For Linux)Linux
Update Tomcat to 9.6.3 (For Linux)Linux
Update Tomcat to 9.6.4 (For Linux)Linux
Update Tomcat to 9.6.7 (For Linux)Linux
Update Tomcat to 9.6.8 (For Linux)Linux
Update Tomcat to 2.4.5 (For Linux)Linux
Update Tomcat to 3.0.14 (For Linux)Linux
Vulnerabilities CVE-2013-4286,CVE-2013-4322,CVE-2013-4590 are fixed in Apache - tomcat for Linux 6.0.39Linux
Vulnerabilities CVE-2013-4286 are fixed in Apache - tomcat for Linux 7.0.47Linux
Vulnerabilities CVE-2013-4286 are fixed in Apache - tomcat for Linux 8.0.0Linux
Improper Input Validation Vulnerability (CVE-2013-4286)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234