CVE-2011-3375
Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests
EPSS 2.0%
Description
Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
How to fix CVE-2011-3375
To remediate CVE-2011-3375, upgrade the affected package to a fixed version below.
- Maven/org.apache.tomcat:tomcat—upgrade to 6.0.35 or later
Is CVE-2011-3375 being exploited?
Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 6.0.30, < 6.0.35