Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Also known as GHSA-3gv7-3h64-78cm

Published 9 y ago 2017-04-17 · modified 5 d ago 2026-11-02 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

16.8%

percentile 97%

Public exploits

none known

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 d ago 2026-11-02

Exploit prediction (EPSS)

16.84% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.tomcat:tomcat`	>=9.0.0.M1, <9.0.0.M19 >=8.5.0, <8.5.13 >=8.0.0, <8.0.43 >=7.0.0, <7.0.77 >=6.0.0, <6.0.53	9.0.0.M19 8.5.13 8.0.43 7.0.77 6.0.53

Affected products

Apache Software Foundation Apache Tomcat

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

security.gentoo.org /glsa/201705-09 · vendor-advisory, x_refsource_GENTOO, x_transferred
security.netapp.com /advisory/ntap-20180614-0001/ · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:3080 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:1801 · vendor-advisory, x_refsource_REDHAT, x_transferred
debian.org /security/2017/dsa-3843 · vendor-advisory, x_refsource_DEBIAN, x_transferred
arubanetworks.com /assets/alert/HPESBHF03730.txt · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:2494 · vendor-advisory, x_refsource_REDHAT, x_transferred
lists.apache.org /thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a%40%3Cusers.tomcat.ap · mailing-list, x_refsource_MLIST, x_transferred
securitytracker.com /id/1038218 · vdb-entry, x_refsource_SECTRACK, x_transferred
debian.org /security/2017/dsa-3842 · vendor-advisory, x_refsource_DEBIAN, x_transferred
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03730en_us · x_refsource_CONFIRM, x_transferred
oracle.com /technetwork/security-advisory/cpujul2017-3236622.html · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:1802 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:2493 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3081 · vendor-advisory, x_refsource_REDHAT, x_transferred
lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-5647 · advisory
github.com /apache/tomcat/commit/864aa1199ad2cccc9a7e7c6b977f7d7f812c9910 · web
github.com /apache/tomcat/commit/a4efd3ca1ccbdfc398136d76c0d8b7ad5a1e4905 · web
github.com /apache/tomcat/commit/f5e06b8c743b1daa9eb5e817863958b6b320e044 · web
github.com /apache/tomcat80/commit/ec10b8c785d1db91fe58946436f854dde04410fd · web
lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apach · web
lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apach · web
lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apach · web
lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apach · web
lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apach · web
security.netapp.com /advisory/ntap-20180614-0001 · web
web.archive.org /web/20170420114447/http://www.securitytracker.com/id/1038218 · web
github.com /apache/tomcat · package
lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache · web

Sources

CVE List: CVE-2017-5647
GitHub Advisory: GHSA-3gv7-3h64-78cm
NVD: CVE-2017-5647

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary