What is the CVSS score of CVE-2020-1935?

CVE-2020-1935 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 9.4%.

Is there a patch available for CVE-2020-1935?

Yes, a patch is available for CVE-2020-1935. Update the affected software to the latest version immediately.

Tomcat CVE-2020-1935

MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2020-02-24 security@apache.org

Apache Request Smuggling Tomcat Information Disclosure Debian Linux Ubuntu Linux Leap Data Availability Services Oncommand System Manager Agile Engineering Data Management Agile Product Lifecycle Management Communications Element Manager Communications Instant Messaging Server Health Sciences Empirica Inspections Health Sciences Empirica Signal Hospitality Guest Access Hyperion Infrastructure Technology Instantis Enterprisetrack Mysql Enterprise Monitor Retail Order Broker Siebel Ui Framework Transportation Management Workload Manager

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Feb 24, 2020 - 22:15 nvd

MEDIUM 4.8

DescriptionNVD

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

AnalysisAI

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as HTTP Request/Response Smuggling (CWE-444), which allows attackers to manipulate HTTP request interpretation between frontend and backend servers. In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. Affected products include: Apache Tomcat, Debian Debian Linux, Canonical Ubuntu Linux, Opensuse Leap, Netapp Data Availability Services.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict HTTP parsing, normalize requests at proxy layer, use HTTP/2 end-to-end, reject ambiguous headers.