While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
CVSS Details
- CVSS 3.0 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Apr 20, 2017 | Apr 17, 2017 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.76Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to 8.5.12Upgrade Apache Tomcat to 8.0.42Upgrade Apache Tomcat to the latest available version | Apr 17, 2017 | Apr 17, 2017 |
| Centos_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-api | Jul 28, 2017 | Apr 17, 2017 |
| Debian | — | Upgrade tomcat7 | May 1, 2017 | Apr 17, 2017 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-api | Nov 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-servlet-3.0-api | Nov 30, 2017 | Apr 17, 2017 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3 | Jun 20, 2017 | Apr 17, 2017 |
| Oracle_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-lib | Jul 28, 2017 | Apr 10, 2017 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Aug 4, 2017 | Apr 17, 2017 |
| Suse | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-libUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_2-api | May 10, 2017 | Apr 17, 2017 |
| Ubuntu | — | Upgrade tomcat7Upgrade tomcat8Upgrade libtomcat8-javaUpgrade libtomcat7-java | Jan 9, 2018 | Apr 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub