Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
10.1.40-1ubuntu1.25.10.111.0.6-19.0.95-1ubuntu1.110.1.40-1ubuntu1.26.04.19.0.115-1ubuntu0.19.0.16-3ubuntu0.18.04.2+esm89.0.31-1ubuntu0.9+esm39.0.58-1ubuntu0.2+esm410.1.16-1ubuntu0.1~esm49.0.70-2ubuntu0.1+esm3Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:LI:LA:LCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L