CVE-2013-2071 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

What is CVE-2013-2071?

CVE-2013-2071 is a low-severity vulnerability in Apache Tomcat, published on 1 Jun 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.

Weakness: CWE-200

Which versions are affected by CVE-2013-2071?

2 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2013-2071?

Upgrade org.apache.tomcat:tomcat to 7.0.40 or later.

Is CVE-2013-2071 being exploited?

There is no known exploitation of CVE-2013-2071 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3p5r-7cw3-2m67, MGASA-2013-0191.