5.3

CVE-2023-45648

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially 
crafted, invalid trailer header could cause Tomcat to treat a single 
request as multiple requests leading to the possibility of request 
smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.0 < 8.5.94
Apache ≫ Tomcat Version >= 9.0.1 < 9.0.81
Apache ≫ Tomcat Version >= 10.1.1 < 10.1.14
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Apache ≫ Tomcat Version9.0.0 Updatemilestone10
Apache ≫ Tomcat Version9.0.0 Updatemilestone11
Apache ≫ Tomcat Version9.0.0 Updatemilestone12
Apache ≫ Tomcat Version9.0.0 Updatemilestone13
Apache ≫ Tomcat Version9.0.0 Updatemilestone14
Apache ≫ Tomcat Version9.0.0 Updatemilestone15
Apache ≫ Tomcat Version9.0.0 Updatemilestone16
Apache ≫ Tomcat Version9.0.0 Updatemilestone17
Apache ≫ Tomcat Version9.0.0 Updatemilestone18
Apache ≫ Tomcat Version9.0.0 Updatemilestone19
Apache ≫ Tomcat Version9.0.0 Updatemilestone2
Apache ≫ Tomcat Version9.0.0 Updatemilestone20
Apache ≫ Tomcat Version9.0.0 Updatemilestone21
Apache ≫ Tomcat Version9.0.0 Updatemilestone22
Apache ≫ Tomcat Version9.0.0 Updatemilestone23
Apache ≫ Tomcat Version9.0.0 Updatemilestone24
Apache ≫ Tomcat Version9.0.0 Updatemilestone25
Apache ≫ Tomcat Version9.0.0 Updatemilestone26
Apache ≫ Tomcat Version9.0.0 Updatemilestone27
Apache ≫ Tomcat Version9.0.0 Updatemilestone3
Apache ≫ Tomcat Version9.0.0 Updatemilestone4
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Apache ≫ Tomcat Version10.1.0 Updatemilestone1
Apache ≫ Tomcat Version10.1.0 Updatemilestone10
Apache ≫ Tomcat Version10.1.0 Updatemilestone11
Apache ≫ Tomcat Version10.1.0 Updatemilestone12
Apache ≫ Tomcat Version10.1.0 Updatemilestone13
Apache ≫ Tomcat Version10.1.0 Updatemilestone14
Apache ≫ Tomcat Version10.1.0 Updatemilestone15
Apache ≫ Tomcat Version10.1.0 Updatemilestone16
Apache ≫ Tomcat Version10.1.0 Updatemilestone17
Apache ≫ Tomcat Version10.1.0 Updatemilestone18
Apache ≫ Tomcat Version10.1.0 Updatemilestone19
Apache ≫ Tomcat Version10.1.0 Updatemilestone2
Apache ≫ Tomcat Version10.1.0 Updatemilestone20
Apache ≫ Tomcat Version10.1.0 Updatemilestone3
Apache ≫ Tomcat Version10.1.0 Updatemilestone4
Apache ≫ Tomcat Version10.1.0 Updatemilestone5
Apache ≫ Tomcat Version10.1.0 Updatemilestone6
Apache ≫ Tomcat Version10.1.0 Updatemilestone7
Apache ≫ Tomcat Version10.1.0 Updatemilestone8
Apache ≫ Tomcat Version10.1.0 Updatemilestone9
Apache ≫ Tomcat Version11.0.0 Updatemilestone1
Apache ≫ Tomcat Version11.0.0 Updatemilestone10
Apache ≫ Tomcat Version11.0.0 Updatemilestone11
Apache ≫ Tomcat Version11.0.0 Updatemilestone2
Apache ≫ Tomcat Version11.0.0 Updatemilestone3
Apache ≫ Tomcat Version11.0.0 Updatemilestone4
Apache ≫ Tomcat Version11.0.0 Updatemilestone5
Apache ≫ Tomcat Version11.0.0 Updatemilestone6
Apache ≫ Tomcat Version11.0.0 Updatemilestone7
Apache ≫ Tomcat Version11.0.0 Updatemilestone8
Apache ≫ Tomcat Version11.0.0 Updatemilestone9
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Debian ≫ Debian Linux Version12.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.73% 0.719
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.