Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.8Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.54Upgrade Apache Tomcat to 6.0.41 | May 31, 2014 | May 31, 2014 |
| Centos_linux | — | Upgrade tomcat6Upgrade tomcat6-admin-webappsUpgrade tomcat6-docs-webappUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat6-libUpgrade tomcat6-javadocUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-servlet-2.5-api | Dec 1, 2016 | May 31, 2014 |
| Debian | — | Upgrade tomcat6 | Mar 28, 2016 | May 31, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | May 31, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1Upgrade web/java-servlet/tomcat to version 6.0.41-0.175.1.21.0.3.0 on Solaris 11.1 | May 29, 2017 | May 31, 2014 |
| Oracle_linux | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-libUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-jsvcUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-docs-webappUpgrade tomcat6-libUpgrade tomcat-el-2.2-apiUpgrade tomcat6-javadocUpgrade tomcat6Upgrade tomcat-docs-webappUpgrade tomcat6-webappsUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat6-admin-webappsUpgrade tomcat-jsp-2.2-api | Oct 16, 2024 | May 31, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | May 27, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 27, 2014 |
| Suse | — | Upgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-docs-webappUpgrade tomcat6-javadocUpgrade tomcat6-libUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6Upgrade libtcnative-1-0Upgrade tomcat6-webapps | Dec 18, 2015 | May 31, 2014 |
| Ubuntu | — | Upgrade libtomcat7-java | Nov 8, 2024 | May 31, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub