CVE-2023-28709
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
A flaw was found in Apache Tomcat due to an incomplete fix for CVE-2023-24998, which aims to limit the uploaded request parts that can be bypassed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-03-21 CVE Reserved
- 2023-05-22 CVE Published
- 2024-06-23 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-193: Off-by-one Error
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2023/05/22/1 | Mailing List |
|
| https://security.gentoo.org/glsa/202305-37 | Third Party Advisory |
|
| https://security.netapp.com/advisory/ntap-20230616-0004 | Third Party Advisory |
|
| https://www.debian.org/security/2023/dsa-5521 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j | 2024-02-16 | |
| https://access.redhat.com/security/cve/CVE-2023-28709 | 2023-11-14 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2210321 | 2023-11-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | >= 8.5.85 <= 8.5.87 Search vendor "Apache" for product "Tomcat" and version " >= 8.5.85 <= 8.5.87" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | >= 9.0.71 <= 9.0.73 Search vendor "Apache" for product "Tomcat" and version " >= 9.0.71 <= 9.0.73" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | >= 10.1.5 <= 10.1.7 Search vendor "Apache" for product "Tomcat" and version " >= 10.1.5 <= 10.1.7" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 11.0.0 Search vendor "Apache" for product "Tomcat" and version "11.0.0" | milestone2 |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 11.0.0 Search vendor "Apache" for product "Tomcat" and version "11.0.0" | milestone3 |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 11.0.0 Search vendor "Apache" for product "Tomcat" and version "11.0.0" | milestone4 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | 7-mode Transition Tool Search vendor "Netapp" for product "7-mode Transition Tool" | - | - |
Affected
| ||||||