Every CVE Search/ Get API key

CVE-2008-3271

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address...

4.3 Medium

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Exploit likelihood

4.81%Down 2.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Record
CVE-2008-3271
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Record
CVE-2008-3271
Updated
2026-11-02
EUVDEUVD-2008-3259 No score

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Record
EUVD-2008-3259
Updated
2026-11-03
GitHub AdvisoriesGHSA-5jpg-mjvg-hfhp No score

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address...

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

Record
GHSA-5jpg-mjvg-hfhp
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tomcat5
Red Hat:network_satellite:5.1::el4
From an advisory covering 5 CVEs
 before 0:5.0.30-0jpp_12rh
0:5.0.30-0jpp_12rh
tomcat5
Red Hat:network_satellite:5.0:el4
From an advisory covering 5 CVEs
 before 0:5.0.30-0jpp_12rh
0:5.0.30-0jpp_12rh

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-3271 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published October 13, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.81%, the 92nd percentile. No source names a fixed version.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open