Summary
This host is running Apache Tomcat with mod_jk Module and is prone to Information Disclosure vulnerability.
Impact
This issue can be exploited to disclose response data associated with the request of a different user via specially crafted HTTP requests and to gain sensitive information about the remote host.
Impact Level: Application
Solution
Upgrade to mod_jk 1.2.27 or later.
http://svn.eu.apache.org/viewvc?view=rev&revision=702540
Insight
This flaw is due to
- an error when handling empty POST requests with a non-zero 'Content-Length' header.
- an error while handling multiple noncompliant AJP protocol related requests.
Affected
Apache Tomcat mod_jk version 1.2.0 to 1.2.26
References
Severity
Classification
-
CVE CVE-2008-5519 -
CVSS Base Score: 2.6
AV:N/AC:H/Au:N/C:P/I:N/A:N
Related Vulnerabilities