CVE-2005-2090

CVE Details

Release Date:2005-07-05

Description


Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a Transfer-Encoding: chunked header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka HTTP Request Smuggling.

See more information about CVE-2005-2090 from MITRE CVE dictionary and NIST NVD


CVSS v2.0 metrics


NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score: 4.3 Base Metrics: AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector: Network Attack Complexity: Medium
Authentication: None required Confidentiality Impact: None
Integrity Impact: Partial Availability Impact: None

Errata information


PlatformErrataRelease Date
Oracle Linux version 5 (jakarta-commons-modeler)ELSA-2007-03272007-06-26
Oracle Linux version 5 (tomcat5)ELSA-2007-03272007-06-26



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete