Information Disclosure in Apache Tomcat's JK Connector by the Apache Software Foundation
CVE-2008-5519

Currently unrated

Key Information:

Vendor

Apache
Status
Mod Jk
Vendor
CVE Published:
9 April 2009

What is CVE-2008-5519?

The Apache Tomcat JK Connector (mod_jk) versions 1.2.0 through 1.2.26 enables remote attackers to gain unauthorized access to sensitive information. This occurs under certain opportunistic conditions, such as when an HTTP request from a different client includes a Content-Length header without accompanying POST data. Additionally, rapid successive requests that do not adhere to the AJP protocol’s standards for handling requests with Content-Length headers can also trigger this vulnerability. The lack of strict compliance opens pathways for potential information leaks.

References

http://www.vupen.com/english/advisories/2009/0973
vdb-entryx_refsource_VUPEN
http://tomcat.apache.org/connectors-doc/miscellaneous/cha...
x_refsource_CONFIRM
http://secunia.com/advisories/34621
third-party-advisoryx_refsource_SECUNIA

EPSS Score

5% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2008-5519 : Information Disclosure in Apache Tomcat's JK Connector by the Apache Software Foundation