地图 / Tomcat examples available for public, Disclosure Apache Tomcat version, Critical/High/Medium CVE

Tomcat examples available for public, Disclosure Apache Tomcat version, Critical/High/Medium CVE

信息泄露 / 错误信息泄露 / #874427

厂商: U.S. Dept Of Defense
严重程度: 低危
赏金: —
弱点: 错误信息泄露
研究员: @pvm
披露日期: 2020-06-11
资产: —
CVE: CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 CVE-2019-0232 CVE-2019-10072 CVE-2019-12418 CVE-2019-17563 CVE-2019-2684 CVE-2020-1935 CVE-2020-1938 CVE-2020-1967

该报告还没有中文解读。

原文摘录

摘自原文（2653 字符中的一小部分）

**Summary:** There are multiple issues found on ███: 1. ███████/examples/ - Apache Tomcat examples are available for public. Multiple issues - session and cookies manipulation, internals IP disclosure. 2. Error page contains information about Apache Tomcat version 3. Reported Tomcat version is …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。

时间线

2020-05-14报告提交
2020-06-11公开披露

阅读 HackerOne 原文 ↗作者 @pvm · 版权归作者与 U.S. Dept Of Defense 所有

同类报告

information disclosure of secret_key_base via encoding charctersGitLab · 2019-06-13 · $3,500 Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeoverU.S. Dept Of Defense · 2024-10-25 A HackerOne employee's GitHub personal access token exposed in Travis CI build logsHackerOne · 2017-05-23 · $2,000 internal path disclosure via register errorTennessee Valley Authority · 2023-11-30 phone number exposure for riders/drivers given email/uuidUber · 2017-06-02 The impossibility of inclusion of the trial (BROWSER)New Relic · — · $200