The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade slf4jUpgrade javassistUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade python3-nssUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade apache-commons-langUpgrade xsom | May 13, 2022 | May 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat | Apr 27, 2020 | May 16, 2018 |
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat80Upgrade tomcat7 | Aug 11, 2018 | May 16, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.52Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.88Upgrade Apache Tomcat to 8.5.31Upgrade Apache Tomcat to 9.0.8 | May 17, 2018 | May 16, 2018 |
| Centos_linux | — | Upgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade javassist-javadocUpgrade tomcat-webappsUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade tomcat-admin-webappsUpgrade glassfish-jaxb-coreUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade javassistUpgrade bea-stax-apiUpgrade tomcat-docs-webappUpgrade slf4jUpgrade tomcat-jsvcUpgrade jackson-coreUpgrade stax-exUpgrade pki-servlet-containerUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade xsomUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade python3-nssUpgrade apache-commons-langUpgrade tomcat-el-2.2-apiUpgrade xerces-j2Upgrade jackson-jaxrs-json-provider | Aug 28, 2019 | May 16, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat7Upgrade tomcat9 | Feb 19, 2019 | May 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-api | Jul 23, 2018 | May 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-webapps | Aug 10, 2018 | May 16, 2018 |
| Oracle Solaris | — | Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3/documentation to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-526 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-522 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-522 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/tests to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/mailman to version 2.1.29.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-27 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-522 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/dotconf to version 1.3-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-526 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser to version 5.12.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/gdm to version 3.24.2-11.4.1.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | May 16, 2018 |
| Oracle_linux | — | Upgrade slf4jUpgrade xml-commons-apisUpgrade resteasyUpgrade velocityUpgrade tomcat-el-2.2-apiUpgrade jackson-coreUpgrade stax-exUpgrade tomcat-libUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xsomUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade tomcat-javadocUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade tomcat-jsp-2.2-apiUpgrade pki-servlet-containerUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade tomcat-jsvcUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade javassistUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade tomcat-admin-webappsUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xmlstreambuffer | Aug 15, 2019 | May 17, 2018 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-javadocUpgrade jackson-databindUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade tomcat-el-2.2-apiUpgrade xalan-j2Upgrade tomcat-docs-webappUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade pki-servlet-containerUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade tomcat-admin-webappsUpgrade xerces-j2Upgrade javassist-javadocUpgrade tomcat-jsp-2.2-apiUpgrade xmlstreambufferUpgrade tomcat-servlet-3.0-apiUpgrade python3-nssUpgrade tomcat-jsvcUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade tomcat-libUpgrade velocityUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade python-nss-debugsourceUpgrade slf4j-jdk14Upgrade stax-exUpgrade python3-nss-debuginfoUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade tomcat-webapps | Jun 19, 2019 | May 16, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | May 16, 2018 |
| Suse | — | Upgrade tomcat-el-2_2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-embedUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-javadocUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-webappsUpgrade tomcat-el-3_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsvc | Sep 14, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat8-javaUpgrade libtomcat7-javaUpgrade tomcat7 | Jun 8, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub