VULNERABILITY INTELLIGENCE
CVE-2016-8747
CVSS score7.5 HIGH
EPSS probability7.12%
CISA KEVNot currently listed
Published2017-03-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Primary references
- security@apache.org — Issue Tracking, Patch, Vendor Advisory
- security@apache.org — Issue Tracking, Patch, Vendor Advisory
- security@apache.org — Release Notes, Vendor Advisory
- security@apache.org — Release Notes, Vendor Advisory
- security@apache.org — Broken Link
- security@apache.org — Patch
- security@apache.org — Patch
- security@apache.org — Patch
- security@apache.org — Patch
- security@apache.org — Patch
- security@apache.org — Patch
- security@apache.org — Third Party Advisory