While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
CVSS Details
- CVSS 3.0 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Apr 20, 2017 | Apr 17, 2017 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to 7.0.76Upgrade Apache Tomcat to 8.5.12Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.0.42 | Apr 17, 2017 | Apr 17, 2017 |
| Centos_linux | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Jul 28, 2017 | Apr 17, 2017 |
| Debian | — | Upgrade tomcat7 | May 1, 2017 | Apr 17, 2017 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-api | Nov 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-api | Nov 30, 2017 | Apr 17, 2017 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3 | Jun 20, 2017 | Apr 17, 2017 |
| Oracle_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-api | Jul 28, 2017 | Apr 10, 2017 |
| Redhat_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadoc | Aug 4, 2017 | Apr 17, 2017 |
| Suse | — | Upgrade tomcat-el-2_2-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat-lib | May 10, 2017 | Apr 17, 2017 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat8-javaUpgrade tomcat7Upgrade tomcat8 | Jan 9, 2018 | Apr 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub