What is CVE-2023-45648?

A security vulnerability, CVE-2023-45648, has been identified in Apache Tomcat, affecting versions 11.0.0-M1 through 11.0.0-M11, 10.1.0-M1 through 10.1.13, 9.0.0-M1 through 9.0.81, and 8.5.0 through 8.5.93. This medium-severity issue involves improper input validation, which can lead to request smuggling when Tomcat is behind a reverse proxy. The vulnerability impacts web servers running the affected versions of Apache Tomcat, as well as systems using these versions in various NetApp products.

Who is impacted by this?

The CVE-2023-45648 vulnerability affects users of Apache Tomcat, specifically those using versions 11.0.0-M1 through 11.0.0-M11, 10.1.0-M1 through 10.1.13, 9.0.0-M1 through 9.0.81, and 8.5.0 through 8.5.93. This issue involves improper input validation, which can lead to request smuggling when Tomcat is behind a reverse proxy. In simpler terms, an attacker could exploit this vulnerability to send misleading requests to the server, potentially causing security breaches or unauthorized access to sensitive information.

What should I do if I’m affected?

If you're affected by the CVE-2023-45648 vulnerability, it's crucial to take action to protect your system. To address this issue, follow these simple steps:

1. Upgrade to Apache Tomcat 11.0.0-M12 or later

2. Upgrade to Apache Tomcat 10.1.14 or later

3. Upgrade to Apache Tomcat 9.0.81 or later

4. Upgrade to Apache Tomcat 8.5.94 or later

By updating your Apache Tomcat installation to the fixed versions, you can mitigate the risk of request smuggling and secure your system.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-45648 vulnerability, an Improper Input Validation issue in Apache Tomcat, is not listed in CISA's Known Exploited Vulnerabilities Catalog. To address this vulnerability, users should upgrade to fixed versions of Apache Tomcat, such as 11.0.0-M12 or later, 10.1.14 or later, 9.0.81 or later, or 8.5.94 or later.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which involves improper input validation in Apache Tomcat, potentially leading to request smuggling.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• oss-security - CVE-2023-45648: Apache Tomcat: Trailer header parsing too lenient

• [SECURITY] CVE-2023-45648 Apache Tomcat - Request Smuggling-Apache Mail Archives

• [SECURITY] [DLA 3617-1] tomcat9 security update

• October 2023 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security