Information disclosure in Apache Tomcat - CVE-2023-34981

Vulnerability identifier: #VU77622

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34981

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to HTTP headers are not set in a response. A remote attacker can send a specially crafted HTTP request and gain unauthorized access to sensitive information on the system.

Apache Tomcat
IBM i Modernization Engine for Lifecycle Integration
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle Retail Xstore Point of Service
DataPower Operations Dashboard
Storage Copy Data Management
UrbanCode Build
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
IBM Data Risk Manager
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Oracle Financial Services Model Management and Governance
Oracle Communications Diameter Signaling Router
Oracle SD-WAN Edge
Management Cloud Engine
Oracle Communications Cloud Native Core Binding Support Function
Netcool Operations Insight
IBM Process Mining
IBM UrbanCode Release
Communications Unified Assurance
Oracle Communications Instant Messaging Server
IBM App Connect Professional
Oracle Agile PLM Framework
Oracle Solaris
Tomcat
watsonx.data
IBM Security SOAR

Install updates from vendor's website.

Apache Tomcat - addressed in versions 8.5.89, 9.0.75, 10.1.9, 11.0.0-M6
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.5
Cloud Pak for Security (CP4S) - update to 1.10.15.0
IBM Data Risk Manager - update to 2.0.6.18
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
Communications Unified Assurance - update to 6.0.3
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.18.00.00
IBM Qradar SIEM - update to 7.5.0 Update Pack 7
Tomcat - update to D.9.0.87.01
DataPower Operations Dashboard - update to 1.0.20.0
Netcool Operations Insight - update to 1.6.11
IBM Process Mining - update to 1.14.2
watsonx.data - update to 2.0.2
Storage Copy Data Management - update to 2.2.23.0
UrbanCode Build - update to 6.1.7.10
IBM UrbanCode Release - update to 6.2.5.11
IBM Security SOAR - update to 50.0

• https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz

• Information disclosure in Apache Tomcat
• Information disclosure in IBM App Connect Professional
• Information disclosure in IBM Security SOAR
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Data Risk Manager
• Information disclosure in IBM Process Mining
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Information disclosure in Oracle Agile PLM Framework
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Information disclosure in Management Cloud Engine
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM UrbanCode Build
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Apache Tomcat
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Information disclosure in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in IBM DataPower Operations Dashboard
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Information disclosure in IBM watsonx.data
• HP-UX update for Tomcat
• Multiple vulnerabilities in Dell Secure Connect Gateway Security Policy Manager