CVE-2020-25122: 
VBulletin vulnerability analysis and mitigation

CVE-2021-25122 is a security vulnerability affecting Apache Tomcat that involves request mix-up with h2c protocol. The vulnerability was disclosed and patched in multiple versions of Apache Tomcat, including those integrated into Oracle and Red Hat products (Oracle CPU Oct 2021, Red Hat Advisory).

The vulnerability is related to the h2c (HTTP/2 Cleartext) protocol implementation in Apache Tomcat. It has been assigned a CVSS base score that indicates moderate severity. The issue affects multiple versions of Tomcat when integrated into various enterprise products, including Oracle Database Enterprise Edition and Red Hat JBoss Web Server (Oracle CPU Jul 2021, Red Hat Advisory).

The vulnerability could potentially lead to request mix-up situations, which might affect the security of web applications running on affected Tomcat servers. The exact impact depends on the specific deployment configuration and usage patterns (Red Hat Advisory).

The vulnerability is remotely exploitable and involves the h2c protocol implementation. It requires network access to the affected Tomcat server to attempt exploitation (Oracle CPU Jul 2021).

Vendors have released patches to address this vulnerability. Oracle has included fixes in their Critical Patch Updates, and Red Hat has provided updated packages for affected products. Users are strongly recommended to apply these security updates to mitigate the risk (Oracle CPU Oct 2021, Red Hat Advisory).