CVE-2013-4286

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 6.0.39 Apache Tomcat versions prior to 7.0.47 Apache Tomcat versions prior to 8.0.0-RC3

Description The issue arises from the improper handling of certain inconsistent HTTP request headers when an HTTP connector or AJP connector is used. This allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via multiple Content-Length headers or a Content-Length header and a "Transfer-Encoding: chunked" header.

Recommendations For Apache Tomcat versions prior to 6.0.39, update to version 6.0.39 or later. For Apache Tomcat versions prior to 7.0.47, update to version 7.0.47 or later. For Apache Tomcat versions prior to 8.0.0-RC3, update to version 8.0.0-RC3 or later.