Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11-9.0.43 - Generation of Error Message Containing Sensitive Information
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-21733. PoCs published by LtmThink.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2024-21733, demonstrating a DoS vulnerability in Apache Tomcat 9.0.43 via crafted HTTP POST requests with mismatched Content-Length headers. The exploit triggers a timeout and error response by sending incomplete data, leveraging specific server-side conditions (English locale).
Description
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Exploits (1)
This repository contains a functional PoC for CVE-2024-21733, demonstrating a DoS vulnerability in Apache Tomcat 9.0.43 via crafted HTTP POST requests with mismatched Content-Length headers. The exploit triggers a timeout and error response by sending incomplete data, leveraging specific server-side conditions (English locale).
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N