Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NApache Tomcat
APPApache7.0.100 – 7.0.1098.5.38 – 8.5.1009.0.13 – 9.0.116 (bez)10.0.0 – 10.1.53 (bez)11.0.0 – 11.0.20 (bez)
Powiązane podatności
Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To...
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5....
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM bas...
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty...