Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/46852?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46852?format=api", "vulnerability_id": "VCID-wyf8-8szf-qbfn", "summary": "Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information\nGeneration of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.", "aliases": [ { "alias": "CVE-2024-21733" }, { "alias": "GHSA-f4qf-m5gf-8jm8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/59005?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.64", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.64" }, { "url": "http://public2.vulnerablecode.io/api/packages/59006?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.44", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.44" }, { "url": "http://public2.vulnerablecode.io/api/packages/58361?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.44", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8qze-3eq1-mbf9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.44" }, { "url": "http://public2.vulnerablecode.io/api/packages/58999?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.64", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.64" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62177?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-nndc-pabd-nbgf" }, { "vulnerability": "VCID-wyf8-8szf-qbfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/68558?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.0-M11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-d8re-94xd-nycp" }, { "vulnerability": "VCID-wyf8-8szf-qbfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.0-M11" }, { "url": "http://public2.vulnerablecode.io/api/packages/68559?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.0-M11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-wyf8-8szf-qbfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.0-M11" }, { "url": "http://public2.vulnerablecode.io/api/packages/68553?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-wyf8-8szf-qbfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.7" } ], "references": [ { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/86ccc43940861703c2be96a5f35384407522125a", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/86ccc43940861703c2be96a5f35384407522125a" }, { "reference_url": "https://github.com/apache/tomcat/commit/ce4b154e7b48f66bd98858626347747cd2514311", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/ce4b154e7b48f66bd98858626347747cd2514311" }, { "reference_url": "https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20240216-0005", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20240216-0005" }, { "reference_url": "https://tomcat.apache.org/security-8.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://tomcat.apache.org/security-8.html" }, { "reference_url": "https://tomcat.apache.org/security-9.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://tomcat.apache.org/security-9.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2024/01/19/2", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2024/01/19/2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733", "reference_id": "CVE-2024-21733", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" }, { "reference_url": "https://github.com/advisories/GHSA-f4qf-m5gf-8jm8", "reference_id": "GHSA-f4qf-m5gf-8jm8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-f4qf-m5gf-8jm8" } ], "weaknesses": [ { "cwe_id": 209, "name": "Generation of Error Message Containing Sensitive Information", "description": "The product generates an error message that includes sensitive information about its environment, users, or associated data." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wyf8-8szf-qbfn" }