Omar Aljabr’s Post

Apache Tomcat HTTP Request Smuggling (Client-Side Desync) Recently, a critical vulnerability was discovered in Apache Tomcat, which was assigned the code CVE-2024-21733 https://lnkd.in/divCDw93 Vulnerable:  from 8.5.7 through 8.5.63 from 9.0.0-M11 through 9.0.43 Patched: 8.5.64 and 9.0.44 #CVE #Tomcat

Apache Tomcat 8.5.63 / 9.0.43 HTTP Response Smuggling: Apache Tomcat suffers from a client-side de-sync vulnerability via HTTP request smuggling. Apache Tomcat versions 8.5.7 through 8.5.63 and 9.0.0-M11 through 9.0.43 are vulnerable.

#Apache Tomcat remote service is here https://lnkd.in/dm_3eKXk #ApacheTomcat #TomcatServer #JavaWebDevelopment #JavaServlets #JSPDevelopment

CVE-2024-21733 - Apache Tomcat vulnerability with severity Critcial. Vulnerability versions: Apache Tomcat version 8 – 8.5.7 to 8.5.63 Apache Tomcat version 9 – 9.0.0-M11 to 9.0.43. https://lnkd.in/gQVuA9mj #apache #tomcat #vulnerability

Need help troubleshooting Tomcat? Read this blog which explains some of the most common errors Tomcat users encounter and how to fix them 🛠️ >> https://ter.li/qfoz0z #apachetomcat #tomcat #opensource

Hello #linkdinfamily I am going to share another new concept called "Apache Tomcat Server" What is Apache Tomcat ? Tomcat is an open-source web server and servlet. It is used widely for hosting Java-based applications on the web. Tomcat offers a lightweight and efficient solution for hosting Java web applications. . I install apache tomcat server under the guidence of my mentor Ashutosh S. Bhakare sir. . #tomcat #server

A critical vulnerability identified as CVE-2024-21733 has been reported in Apache Tomcat, affecting versions from 8.5.7 through 8.5.63 and from 9.0.0-M11 through 9.0.43. This vulnerability pertains to the generation of error messages that could potentially contain sensitive information. The National Vulnerability Database has rated the severity of this issue as medium with a CVSS 3.x base score of 5.3. It is essential for users to upgrade to version 8.5.64 or higher, or to version 9.0.44 or higher to resolve this vulnerability as no workarounds are advised [➊](https://lnkd.in/dE7T-Zds) [➋](https://lnkd.in/dR-2ns48) [➌](https://lnkd.in/dmyGeJ6C). For further details, you can refer to the advisories and discussions on the matter provided by various sources such as the National Vulnerability Database, Vulert, and Rapid7, which host information about this vulnerability and the updates necessary to mitigate the risks associated with it [➍](https://lnkd.in/dE7T-Zds) [➎](https://lnkd.in/dR-2ns48) [➏](https://lnkd.in/dmyGeJ6C).

The default port for Apache Tomcat is 8080. This port is used to access the Tomcat web server over HTTP. However, if this port is already in use or if you want to change it for any reason, you can modify the server.xml configuration file in the Tomcat installation directory. Here's how you can change the port in Tomcat: Locate the server.xml file in the conf directory of your Tomcat installation. Typically, this file is located at: /path/to/tomcat/conf/server.xml. Open the server.xml file in a text editor. Search for the <Connector> element that specifies the port. By default, it looks like this: xml <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> Change the port attribute to the desired port number. For example, to change it to port 8888: <Connector port="8888" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> Save the server.xml file and restart the Tomcat server for the changes to take effect. After restarting Tomcat, you should be able to access the Tomcat web server using the new port number (e.g., http://localhost:8888). Remember that if you're using a firewall, you may need to open the new port to allow incoming connections. Additionally, ensure that the new port doesn't conflict with any other services running on the server. #ApacheTomcat #PortChange #ServerConfiguration #WebDevelopment

Current plan is to set up a vulnerable Apache web server