Apache Tomcat: Fix for CVE-2023-24998 is incomplete
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 11.0.0-M5, 10.1.8, 9.0.74, 8.5.88
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Software Foundation Apache Tomcat
From 11.0.0-M2 · through 11.0.0-M4; From 10.1.5 · through 10.1.7; From 9.0.71 · through 9.0.73; From 8.5.85 · through 8.5.87
- org.apache.tomcat.embed:tomcat-embed-coreMaven
From 11.0.0-M2 · fixed in 11.0.0-M5
- org.apache.tomcat.embed:tomcat-embed-coreMaven
From 10.1.5 · fixed in 10.1.8
- org.apache.tomcat.embed:tomcat-embed-coreMaven
From 9.0.71 · fixed in 9.0.74
- org.apache.tomcat:tomcat-coyoteMaven
From 8.5.85 · fixed in 8.5.88