CVE-2008-4308: Infoleak
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4308?
CVE-2008-4308 has a medium severity rating due to the potential for sensitive data leakage between requests.
How do I fix CVE-2008-4308?
To fix CVE-2008-4308, upgrade Apache Tomcat to version 5.5.21 or higher, or to version 4.1.35 or higher.
What versions of Apache Tomcat are affected by CVE-2008-4308?
CVE-2008-4308 affects Apache Tomcat versions 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20.
Is CVE-2008-4308 a remote code execution vulnerability?
No, CVE-2008-4308 is not a remote code execution vulnerability, but it can lead to sensitive data exposure.
What is the impact of CVE-2008-4308 on web applications?
The impact of CVE-2008-4308 on web applications includes the risk of POST content being incorrectly sent to different requests, potentially exposing sensitive information.