Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 3 products
`Apache Tomcat` has an incomplete fix (CVE-2023-28709) for a previous request smuggling vulnerability. Review your `Tomcat` deployments. #ApacheTomcat #Vulnerability #infosec https://www.pulsepatch.io/posts/cve-2023-28709-apache-tomcat-incomplete-fix
Post summary
Apache Tomcat has an incomplete fix for CVE-2023-28709, a request smuggling vulnerability; administrators are advised to review deployments to ensure proper mitigation.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | tomcat | - | - | - |
| App | apache | tomcat | 11.0.0 | - | - |
| App | apache | tomcat | 11.0.0 | - | - |
| App | apache | tomcat | 11.0.0 | - | - |
| OS | debian | debian_linux | 12.0 | - | - |
| App | netapp | 7-mode_transition_tool | - | - | - |