NVD

Id
39913  
Name
CVE-2013-4286  
Description
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request"s length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2014-02-26  
Modified Date
2016-12-07  
Seq
2013-4286  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
202996 39913 CVE-2013-4286 http://advisories.mageia.org/MGASA-2014-0148.html  View
202997 39913 CVE-2013-4286 HPSBUX03150  View
202998 39913 CVE-2013-4286 HPSBOV03503  View
202999 39913 CVE-2013-4286 RHSA-2014:0343  View
203000 39913 CVE-2013-4286 RHSA-2014:0344  View
203001 39913 CVE-2013-4286 RHSA-2014:0345  View
203002 39913 CVE-2013-4286 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
203003 39913 CVE-2013-4286 http://svn.apache.org/viewvc?view=revision&revision=1521829  View
203004 39913 CVE-2013-4286 http://svn.apache.org/viewvc?view=revision&revision=1521854  View
203005 39913 CVE-2013-4286 http://svn.apache.org/viewvc?view=revision&revision=1552565  View
203006 39913 CVE-2013-4286 http://tomcat.apache.org/security-6.html  View
203007 39913 CVE-2013-4286 http://tomcat.apache.org/security-7.html  View
203008 39913 CVE-2013-4286 http://tomcat.apache.org/security-8.html  View
203009 39913 CVE-2013-4286 http://www-01.ibm.com/support/docview.wss?uid=swg21667883  View
203010 39913 CVE-2013-4286 http://www-01.ibm.com/support/docview.wss?uid=swg21675886  View
203011 39913 CVE-2013-4286 http://www-01.ibm.com/support/docview.wss?uid=swg21677147  View
203012 39913 CVE-2013-4286 http://www-01.ibm.com/support/docview.wss?uid=swg21678113  View
203013 39913 CVE-2013-4286 http://www-01.ibm.com/support/docview.wss?uid=swg21678231  View
203014 39913 CVE-2013-4286 DSA-3530  View
203015 39913 CVE-2013-4286 MDVSA-2015:052  View
203016 39913 CVE-2013-4286 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
203017 39913 CVE-2013-4286 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html  View
203018 39913 CVE-2013-4286 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html  View
203019 39913 CVE-2013-4286 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
203020 39913 CVE-2013-4286 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
203021 39913 CVE-2013-4286 65773  View
203022 39913 CVE-2013-4286 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
203023 39913 CVE-2013-4286 https://bugzilla.redhat.com/show_bug.cgi?id=1069921  View
203024 39913 CVE-2013-4286 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013  View
203025 39913 CVE-2013-4286 RHSA-2014:0686  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24514 JVNDB-2013-006089 Apache Tomcat におけるリクエスト長の誤った識別を誘発される脆弱性 Apache Tomcat は、HTTP コネクタまたは AJP コネクタが使用されている場合、特定の矛盾する HTTP リクエストヘッダを適切に処理しないため、リクエスト長の誤った識別を誘発され、リクエスト・スマグリング攻撃を実行される脆弱性が存在します。 CVE-2013-4286 64228 CVE-2013-4286 39913 5.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006089.html 2013-09-23 2016-11-22 View