CVE-2008-4308: Exposure of Sensitive Information to an Unauthorized Actor
(updated )
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
References
- jvn.jp/en/jp/JVN66905322/index.html
- jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html
- github.com/advisories/GHSA-7g59-hm8v-cwmc
- issues.apache.org/bugzilla/show_bug.cgi?id=40771
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- nvd.nist.gov/vuln/detail/CVE-2008-4308
- web.archive.org/web/20090228052951/http://secunia.com/advisories/34057
- web.archive.org/web/20111229174634/http://www.securityfocus.com/archive/1/501250
- web.archive.org/web/20201207165808/http://www.securityfocus.com/bid/33913
Code Behaviors & Features
Detect and mitigate CVE-2008-4308 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →