An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

An update of the apache package has been released.

The version of Tomcat installed on the remote host is prior to 9.0.0.M17. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.0.m17_security-9 advisory.

  - An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15     in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was     intended to be associated with a different request. (CVE-2016-8747)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.11. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.11_security-8 advisory.

  - An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15     in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was     intended to be associated with a different request. (CVE-2016-8747)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is version 8.5.x prior to 8.5.11 or 9.0.0.x prior to 9.0.0.M17, and is affected by a flaw in the 'nextRequest()' function in 'http11/Http11InputBuffer.java' that is triggered as limits of a ByteBuffer are not properly set, resulting in the contents of a ByteBuffer leaking between HTTP requests. This may allow a remote attacker to read potentially sensitive information from other requests on the same connection.

Note that Nessus Network Monitor has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203062	Photon OS 1.0: Apache PHSA-2017-0012	Nessus	PhotonOS Local Security Checks	high
99362	Apache Tomcat 9.0.0.M11 < 9.0.0.M17	Nessus	Web Servers	high
99361	Apache Tomcat 8.5.7 < 8.5.11	Nessus	Web Servers	high
700007	Apache Tomcat 8.5.7 < 8.5.11 / 9.0.0.M11 < 9.0.0.M17 nextRequest Information Disclosure	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2016-8747

high

Tenable Plugins

high

high

high

medium