The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade xsomUpgrade slf4jUpgrade javassistUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade xalan-j2Upgrade javassist-javadocUpgrade stax-exUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade glassfish-jaxb-core | May 13, 2022 | May 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-api | Apr 27, 2020 | May 16, 2018 |
| Amazon_linux | — | Upgrade tomcat80Upgrade tomcat7Upgrade tomcat8 | Aug 11, 2018 | May 16, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.8Upgrade Apache Tomcat to 8.5.31Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.88Upgrade Apache Tomcat to 8.0.52 | May 17, 2018 | May 16, 2018 |
| Centos_linux | — | Upgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade jakarta-commons-httpclientUpgrade tomcatUpgrade javassistUpgrade python-nss-debugsourceUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade tomcat-webappsUpgrade tomcat-libUpgrade python-nss-docUpgrade python3-nssUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade tomcat-el-2.2-apiUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade jackson-annotationsUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade xsomUpgrade resteasyUpgrade xml-commons-apisUpgrade tomcat-jsvcUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade pki-servlet-containerUpgrade tomcat-servlet-3.0-api | Aug 28, 2019 | May 16, 2018 |
| Debian | — | Upgrade tomcat8Upgrade tomcat9Upgrade tomcat7 | Feb 19, 2019 | May 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-api | Jul 23, 2018 | May 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-lib | Aug 10, 2018 | May 16, 2018 |
| Oracle Solaris | — | Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | May 16, 2018 |
| Oracle_linux | — | Upgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade tomcat-webappsUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade tomcat-docs-webappUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsvcUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade velocityUpgrade slf4jUpgrade tomcat-el-2.2-apiUpgrade xalan-j2Upgrade apache-commons-langUpgrade tomcat-libUpgrade pki-servlet-containerUpgrade relaxngDatatypeUpgrade xsomUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade tomcat-javadocUpgrade stax-exUpgrade tomcat-jsp-2.2-api | Aug 15, 2019 | May 17, 2018 |
| Redhat_linux | — | Upgrade tomcat-el-2.2-apiUpgrade pki-servlet-containerUpgrade tomcat-javadocUpgrade xml-commons-apisUpgrade jakarta-commons-httpclientUpgrade tomcat-admin-webappsUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade tomcatUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade tomcat-jsp-2.2-apiUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade xalan-j2Upgrade tomcat-servlet-3.0-apiUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade resteasyUpgrade javassistUpgrade slf4jUpgrade tomcat-docs-webappUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade tomcat-webappsUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade stax-exUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade slf4j-jdk14Upgrade tomcat-libUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade tomcat-jsvcUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providers | Jun 19, 2019 | May 16, 2018 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | May 16, 2018 |
| Suse | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_2-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-libUpgrade tomcat-el-2_2-apiUpgrade tomcat-servlet-3_0-api | Sep 14, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade tomcat7Upgrade tomcat8Upgrade libtomcat8-java | Jun 8, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub