CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.3. It affects Apache. Its EPSS score suggests a 75.4% probability of exploitation in the next 30 days.
CVE
CVE-2021-33037
Severity
MEDIUM
CVSS
5.3
EPSS
75.35%
Apache
Original NVD Description
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Related CVEs
Other vulnerabilities affecting the same vendor(s)