Test ID:	1.3.6.1.4.1.25623.1.0.148839
Category:	Web Servers
Title:	Apache Tomcat Request Smuggling Vulnerability (Oct 2022) - Linux
Summary:	Apache Tomcat is prone to a request smuggling vulnerability.
Description:	Summary: Apache Tomcat is prone to a request smuggling vulnerability. Vulnerability Insight: If Tomcat is configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat does not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat is located behind a reverse proxy that also fails to reject the request with the invalid header. Affected Software/OS: Apache Tomcat version 8.5.0 through 8.5.82, 9.0.0-M1 through 9.0.67, 10.0.0-M1 through 10.0.26 and 10.1.0. Solution: Update to version 8.5.83, 9.0.68, 10.0.27, 10.1.1 or later. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-42252 https://security.gentoo.org/glsa/202305-37 https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
Copyright	Copyright (C) 2022 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.