CVE-2023-34981

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	11.0.0-M5; 10.1.8; 9.0.74; 8.5.88
apache	tomcat	10.1.8; 11.0.0; 8.5.88; 9.0.74

References

https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory
https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory

Timeline

Published: Jun 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-349827.1This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with S CVE-2023-349836.5Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauth CVE-2023-349848.8A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allo CVE-2023-349858.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349868.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349878.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349888.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349898.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-34994.8The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, whi CVE-2023-349909.8A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized c CVE-2023-349919.8A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and CVE-2023-349929.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e