CVE-2005-2090: XSS
From http://tomcat.apache.org/security-5.html
Fixed in Apache Tomcat 5.5.23
Information disclosure CVE-2005-2090
Requests with multiple content-length headers should be rejected as invalid. When multiple components (firewalls, caches, proxies and Tomcat) process a sequence of requests where one or more requests contain multiple content-length headers and several components do not reject the request and make different decisions as to which content-length leader to use an attacker can poision a web-cache, perform an XSS attack and obtain senstive information from requests other then their own. Tomcat now returns 400 for requests with multiple content-length headers.
Affects: 5.0.0-5.0.HEAD, 5.5.0-5.5.22
Other sources
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2005-2090?
The severity of CVE-2005-2090 is classified as high due to its potential for remote exploitation.
How do I fix CVE-2005-2090?
To fix CVE-2005-2090, upgrade to Apache Tomcat version 5.0.20 or later, or 4.1.25 or later.
Which versions of Tomcat are affected by CVE-2005-2090?
CVE-2005-2090 affects Apache Tomcat versions 4.1.24 and earlier, as well as 5.0.19 and earlier.
What type of attacks can CVE-2005-2090 facilitate?
CVE-2005-2090 can facilitate web cache poisoning, bypassing web application firewalls, and cross-site scripting (XSS) attacks.
Is CVE-2005-2090 related to any other vulnerabilities?
Yes, CVE-2005-2090 shares similarities with other vulnerabilities that exploit improper input processing in web applications.