What is the severity of CVE-2005-2090?

The severity of CVE-2005-2090 is classified as high due to its potential for remote exploitation.

How do I fix CVE-2005-2090?

To fix CVE-2005-2090, upgrade to Apache Tomcat version 5.0.20 or later, or 4.1.25 or later.

Which versions of Tomcat are affected by CVE-2005-2090?

CVE-2005-2090 affects Apache Tomcat versions 4.1.24 and earlier, as well as 5.0.19 and earlier.

What type of attacks can CVE-2005-2090 facilitate?

CVE-2005-2090 can facilitate web cache poisoning, bypassing web application firewalls, and cross-site scripting (XSS) attacks.

Is CVE-2005-2090 related to any other vulnerabilities?

Yes, CVE-2005-2090 shares similarities with other vulnerabilities that exploit improper input processing in web applications.

Vulnerability/
CVE-2005-2090

medium

4.3

CWE

79 NVD-CWE-Other

6/6/2005

30/6/2005

1/5/2022

7/8/2024

CVE-2005-2090: XSS

First published: Mon Jun 06 2005(Updated: )

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
maven/org.apache.tomcat:tomcat	>=4.0.0<=4.1.24
maven/org.apache.tomcat:tomcat	>=5.0.0<=5.0.19
redhat/pcsc-lite	<0:1.3.3-3.el4	0:1.3.3-3.el4
redhat/rhpki-ca	<0:7.3.0-20.el4	0:7.3.0-20.el4
redhat/rhpki-java-tools	<0:7.3.0-10.el4	0:7.3.0-10.el4
redhat/rhpki-kra	<0:7.3.0-14.el4	0:7.3.0-14.el4
redhat/rhpki-manage	<0:7.3.0-19.el4	0:7.3.0-19.el4
redhat/rhpki-native-tools	<0:7.3.0-6.el4	0:7.3.0-6.el4
redhat/rhpki-ocsp	<0:7.3.0-13.el4	0:7.3.0-13.el4
redhat/rhpki-tks	<0:7.3.0-13.el4	0:7.3.0-13.el4
redhat/jakarta-commons-modeler	<0:1.1-8jpp.1.0.2.el5	0:1.1-8jpp.1.0.2.el5
redhat/tomcat5	<0:5.5.23-0jpp.1.0.3.el5	0:5.5.23-0jpp.1.0.3.el5
redhat/java	<1.4.2-ibm-0:1.4.2.10-1jpp.2.el4	1.4.2-ibm-0:1.4.2.10-1jpp.2.el4
redhat/rhn-apache	<0:1.3.27-36.rhn.rhel4	0:1.3.27-36.rhn.rhel4
redhat/rhn-modjk	<0:1.2.23-2rhn.rhel4	0:1.2.23-2rhn.rhel4
redhat/rhn-modperl	<0:1.29-16.rhel4	0:1.29-16.rhel4
redhat/rhn-modssl	<0:2.8.12-8.rhn.10.rhel4	0:2.8.12-8.rhn.10.rhel4
redhat/java	<1.4.2-ibm-0:1.4.2.10-1jpp.2.el3	1.4.2-ibm-0:1.4.2.10-1jpp.2.el3
redhat/rhn-apache	<0:1.3.27-36.rhn.rhel3	0:1.3.27-36.rhn.rhel3
redhat/rhn-modjk	<0:1.2.23-2rhn.rhel3	0:1.2.23-2rhn.rhel3
redhat/rhn-modperl	<0:1.29-16.rhel3	0:1.29-16.rhel3
redhat/rhn-modssl	<0:2.8.12-8.rhn.10.rhel3	0:2.8.12-8.rhn.10.rhel3
redhat/jbossas	<0:4.0.5-2.CP04.el4	0:4.0.5-2.CP04.el4
Apache Tomcat	=4.1.24
Apache Tomcat	=5.0.19

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

What is the severity of CVE-2005-2090?
The severity of CVE-2005-2090 is classified as high due to its potential for remote exploitation.
How do I fix CVE-2005-2090?
To fix CVE-2005-2090, upgrade to Apache Tomcat version 5.0.20 or later, or 4.1.25 or later.
Which versions of Tomcat are affected by CVE-2005-2090?
CVE-2005-2090 affects Apache Tomcat versions 4.1.24 and earlier, as well as 5.0.19 and earlier.
What type of attacks can CVE-2005-2090 facilitate?
CVE-2005-2090 can facilitate web cache poisoning, bypassing web application firewalls, and cross-site scripting (XSS) attacks.
Is CVE-2005-2090 related to any other vulnerabilities?
Yes, CVE-2005-2090 shares similarities with other vulnerabilities that exploit improper input processing in web applications.

collector/github-advisory-latest
alias/GHSA-f2gq-p6qv-ccw4
alias/CVE-2005-2090
collector/github-advisory
collector/nvd-index
collector/nvd-cve
collector/nvd-historical
collector/nvd-api
agent/type
agent/first-publish-date
agent/softwarecombine
collector/redhat-bugzilla
source/Red Hat
collector/redhat-cve
agent/software-canonical-lookup
agent/references
agent/severity
agent/weakness
agent/author
agent/description
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/event
agent/trending
agent/tags
agent/source
package-manager/maven
vendor/apache
canonical/apache tomcat
version/apache tomcat/4.1.24
version/apache tomcat/5.0.19
package-manager/redhat

Frequently Asked Questions

What is the severity of CVE-2005-2090?
The severity of CVE-2005-2090 is classified as high due to its potential for remote exploitation.
How do I fix CVE-2005-2090?
To fix CVE-2005-2090, upgrade to Apache Tomcat version 5.0.20 or later, or 4.1.25 or later.
Which versions of Tomcat are affected by CVE-2005-2090?
CVE-2005-2090 affects Apache Tomcat versions 4.1.24 and earlier, as well as 5.0.19 and earlier.
What type of attacks can CVE-2005-2090 facilitate?
CVE-2005-2090 can facilitate web cache poisoning, bypassing web application firewalls, and cross-site scripting (XSS) attacks.
Is CVE-2005-2090 related to any other vulnerabilities?
Yes, CVE-2005-2090 shares similarities with other vulnerabilities that exploit improper input processing in web applications.

CVE-2005-2090: XSS

Never miss a vulnerability like this again

Reference Links

Parent vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2005-2090?

How do I fix CVE-2005-2090?

Which versions of Tomcat are affected by CVE-2005-2090?

What type of attacks can CVE-2005-2090 facilitate?

Is CVE-2005-2090 related to any other vulnerabilities?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2005-2090?

How do I fix CVE-2005-2090?

Which versions of Tomcat are affected by CVE-2005-2090?

What type of attacks can CVE-2005-2090 facilitate?

Is CVE-2005-2090 related to any other vulnerabilities?