CVE-2022-25762

 

Published at: - 13-05-2022 10:15

Last modified: - 25-07-2022 08:22

Total changes: - 5

Description

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

 

Verification logic

 

Reference

• https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c
• https://security.netapp.com/advisory/ntap-20220629-0003/
• N/A-

 

Keywords

NVD

 

CVE-2022-25762

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures