CVE-2008-3271

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-10-13 · updated 2026-06-16
Weakness: CWE-264

Description

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Affected products

Apache Tomcat: 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.3-beta, 4.1.4 (+28)

References

http://jvn.jp/en/jp/JVN30732239/index.html
http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000069.html
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00012.html
http://secunia.com/advisories/32213
http://secunia.com/advisories/32234
http://secunia.com/advisories/32398
http://secunia.com/advisories/35684
http://securityreason.com/securityalert/4396
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200806e.html
http://www.nec.co.jp/security-info/secinfo/nv09-006.html

Get alerted when CVE-2008-3271 or the next vulnerability affects your stack