Detections
Analytics

Apache Tomcat 10.1.0-M1 < 10.1.0-M15 EncryptInterceptor DoS

high Web App Scanning Plugin ID 113233

Language:

Synopsis

Apache Tomcat 10.1.0-M1 < 10.1.0-M15 EncryptInterceptor DoS

Description

The version of Apache Tomcat installed on the remote host is 8.5.38 to 8.5.78, 9.0.13 to 9.0.62, 10.0.0-M1 to 10.0.20 or 10.1.0-M1 to 10.1.0-M14. It is, therefore, affected by a denial of service vulnerability. The documentation for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Tomcat version 10.1.0.M15 or later.

See Also

https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.0-M15

Plugin Details

Severity: High

ID: 113233

Type: remote

Published: 5/13/2022

Updated: 3/14/2023

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-29885

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS Score Source: CVE-2022-29885

Vulnerability Information

CPE: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/11/2022

Vulnerability Publication Date: 5/11/2022

Reference Information

CVE: CVE-2022-29885