The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-apache-commons-collectionsalma-upgrade-apache-commons-langalma-upgrade-bea-stax-apialma-upgrade-glassfish-fastinfosetalma-upgrade-glassfish-jaxb-apialma-upgrade-glassfish-jaxb-corealma-upgrade-glassfish-jaxb-runtimealma-upgrade-glassfish-jaxb-txw2alma-upgrade-jackson-module-jaxb-annotationsalma-upgrade-jakarta-commons-httpclientalma-upgrade-javassistalma-upgrade-javassist-javadocalma-upgrade-python-nss-docalma-upgrade-python3-nssalma-upgrade-relaxngdatatypealma-upgrade-slf4jalma-upgrade-slf4j-jdk14alma-upgrade-stax-exalma-upgrade-velocityalma-upgrade-xalan-j2alma-upgrade-xerces-j2alma-upgrade-xml-commons-apisalma-upgrade-xml-commons-resolveralma-upgrade-xmlstreambufferalma-upgrade-xsom | May 13, 2022 | May 16, 2018 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-2-2-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-2-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-0-apiamazon-linux-ami-2-upgrade-tomcat-webapps | Apr 27, 2020 | May 16, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade--tomcat80amazon-linux-upgrade-tomcat7amazon-linux-upgrade-tomcat8 | Aug 11, 2018 | May 16, 2018 |
| Apache Tomcat | apache-tomcat-upgrade-7_0_88apache-tomcat-upgrade-8_0_52apache-tomcat-upgrade-8_5_31apache-tomcat-upgrade-9_0_8apache-tomcat-upgrade-latest | May 17, 2018 | May 16, 2018 | |
| Centos_linux | — | centos-upgrade-apache-commons-collectionscentos-upgrade-apache-commons-langcentos-upgrade-bea-stax-apicentos-upgrade-glassfish-fastinfosetcentos-upgrade-glassfish-jaxb-apicentos-upgrade-glassfish-jaxb-corecentos-upgrade-glassfish-jaxb-runtimecentos-upgrade-glassfish-jaxb-txw2centos-upgrade-jackson-annotationscentos-upgrade-jackson-corecentos-upgrade-jackson-databindcentos-upgrade-jackson-jaxrs-json-providercentos-upgrade-jackson-jaxrs-providerscentos-upgrade-jackson-module-jaxb-annotationscentos-upgrade-jakarta-commons-httpclientcentos-upgrade-javassistcentos-upgrade-javassist-javadoccentos-upgrade-pki-servlet-4-0-apicentos-upgrade-pki-servlet-containercentos-upgrade-python-nss-debugsourcecentos-upgrade-python-nss-doccentos-upgrade-python3-nsscentos-upgrade-python3-nss-debuginfocentos-upgrade-relaxngdatatypecentos-upgrade-resteasycentos-upgrade-slf4jcentos-upgrade-slf4j-jdk14centos-upgrade-stax-excentos-upgrade-tomcatcentos-upgrade-tomcat-admin-webappscentos-upgrade-tomcat-docs-webappcentos-upgrade-tomcat-el-2-2-apicentos-upgrade-tomcat-javadoccentos-upgrade-tomcat-jsp-2-2-apicentos-upgrade-tomcat-jsvccentos-upgrade-tomcat-libcentos-upgrade-tomcat-servlet-3-0-apicentos-upgrade-tomcat-webappscentos-upgrade-velocitycentos-upgrade-xalan-j2centos-upgrade-xerces-j2centos-upgrade-xml-commons-apiscentos-upgrade-xml-commons-resolvercentos-upgrade-xmlstreambuffercentos-upgrade-xsom | Aug 28, 2019 | May 16, 2018 |
| Debian | debian-upgrade-tomcat7debian-upgrade-tomcat8debian-upgrade-tomcat9 | Feb 19, 2019 | May 16, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-tomcathuawei-euleros-2_0_sp2-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp2-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp2-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp2-upgrade-tomcat-libhuawei-euleros-2_0_sp2-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp2-upgrade-tomcat-webapps | Jul 23, 2018 | May 16, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-tomcathuawei-euleros-2_0_sp3-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp3-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-libhuawei-euleros-2_0_sp3-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp3-upgrade-tomcat-webapps | Aug 10, 2018 | May 16, 2018 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-8-5-32-0-175-3-35-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-32-0-175-3-35-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-32-0-175-3-35-0-4-0oracle-solaris-11-4-upgrade-database-mysql-57-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-client-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-embedded-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-library-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-mysql-57-tests-5-7-23-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-sqlite-3-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-database-sqlite-3-documentation-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-tshark-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-diagnostic-wireshark-wireshark-common-2-6-3-11-4-1-0-1-2-0oracle-solaris-11-4-upgrade-image-library-libjpeg-6-0-2-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-dotconf-1-3-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-speech-dispatcher-0-8-6-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-desktop-webkitgtk4-2-18-6-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-liblouis-3-5-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-5-8-4-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-522-0-16-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-authen-pam-526-0-16-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-522-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-cgi-526-4-37-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-522-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-database-526-1-636-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-522-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-mysql-526-4042-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-522-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-dbd-sqlite-526-1-58-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-522-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-gettext-526-1-0-7-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-522-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-net-ssleay-526-1-80-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-522-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-526-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-tk-804-33-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-522-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-perl-x11-protocol-526-0-56-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-522-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-pmtools-526-2-0-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-522-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-libxml-526-2-128-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-522-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-namespacesupport-526-1-11-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-5-12-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-522-2-44-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-parser-526-2-44-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-522-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-526-0-99-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-522-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-sax-base-526-1-8-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-522-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-perl-5-xml-simple-526-2-24-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-27-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-34-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-python-pyatspi2-35-2-18-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-library-speech-espeak-1-44-0-5-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-mailman-2-1-29-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-thunderbird-52-9-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-52-9-1-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-runtime-tcl-8-tcl-sqlite-3-3-24-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-system-display-manager-desktop-startup-0-38-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-system-display-manager-gdm-3-24-2-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-522-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-terminal-cssh-526-4-9-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-curl-7-61-0-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-32-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-34-11-4-1-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-34-11-4-1-0-1-1-0 | Aug 24, 2018 | May 16, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-apache-commons-collectionsoracle-linux-upgrade-apache-commons-langoracle-linux-upgrade-bea-stax-apioracle-linux-upgrade-glassfish-fastinfosetoracle-linux-upgrade-glassfish-jaxb-apioracle-linux-upgrade-glassfish-jaxb-coreoracle-linux-upgrade-glassfish-jaxb-runtimeoracle-linux-upgrade-glassfish-jaxb-txw2oracle-linux-upgrade-jackson-annotationsoracle-linux-upgrade-jackson-coreoracle-linux-upgrade-jackson-databindoracle-linux-upgrade-jackson-jaxrs-json-provideroracle-linux-upgrade-jackson-jaxrs-providersoracle-linux-upgrade-jackson-module-jaxb-annotationsoracle-linux-upgrade-jakarta-commons-httpclientoracle-linux-upgrade-javassistoracle-linux-upgrade-javassist-javadocoracle-linux-upgrade-pki-servlet-4-0-apioracle-linux-upgrade-pki-servlet-containeroracle-linux-upgrade-python3-nssoracle-linux-upgrade-python-nss-docoracle-linux-upgrade-relaxngdatatypeoracle-linux-upgrade-resteasyoracle-linux-upgrade-slf4joracle-linux-upgrade-slf4j-jdk14oracle-linux-upgrade-stax-exoracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-2-2-apioracle-linux-upgrade-tomcat-javadocoracle-linux-upgrade-tomcat-jsp-2-2-apioracle-linux-upgrade-tomcat-jsvcoracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-3-0-apioracle-linux-upgrade-tomcat-webappsoracle-linux-upgrade-velocityoracle-linux-upgrade-xalan-j2oracle-linux-upgrade-xerces-j2oracle-linux-upgrade-xml-commons-apisoracle-linux-upgrade-xml-commons-resolveroracle-linux-upgrade-xmlstreambufferoracle-linux-upgrade-xsom | Aug 15, 2019 | May 17, 2018 |
| Redhat_linux | redhat-upgrade-apache-commons-collectionsredhat-upgrade-apache-commons-langredhat-upgrade-bea-stax-apiredhat-upgrade-glassfish-fastinfosetredhat-upgrade-glassfish-jaxb-apiredhat-upgrade-glassfish-jaxb-coreredhat-upgrade-glassfish-jaxb-runtimeredhat-upgrade-glassfish-jaxb-txw2redhat-upgrade-jackson-annotationsredhat-upgrade-jackson-coreredhat-upgrade-jackson-databindredhat-upgrade-jackson-jaxrs-json-providerredhat-upgrade-jackson-jaxrs-providersredhat-upgrade-jackson-module-jaxb-annotationsredhat-upgrade-jakarta-commons-httpclientredhat-upgrade-javassistredhat-upgrade-javassist-javadocredhat-upgrade-pki-servlet-4-0-apiredhat-upgrade-pki-servlet-containerredhat-upgrade-python-nss-debugsourceredhat-upgrade-python-nss-docredhat-upgrade-python3-nssredhat-upgrade-python3-nss-debuginforedhat-upgrade-relaxngdatatyperedhat-upgrade-resteasyredhat-upgrade-slf4jredhat-upgrade-slf4j-jdk14redhat-upgrade-stax-exredhat-upgrade-tomcatredhat-upgrade-tomcat-admin-webappsredhat-upgrade-tomcat-docs-webappredhat-upgrade-tomcat-el-2-2-apiredhat-upgrade-tomcat-javadocredhat-upgrade-tomcat-jsp-2-2-apiredhat-upgrade-tomcat-jsvcredhat-upgrade-tomcat-libredhat-upgrade-tomcat-servlet-3-0-apiredhat-upgrade-tomcat-webappsredhat-upgrade-velocityredhat-upgrade-xalan-j2redhat-upgrade-xerces-j2redhat-upgrade-xml-commons-apisredhat-upgrade-xml-commons-resolverredhat-upgrade-xmlstreambufferredhat-upgrade-xsom | Jun 19, 2019 | May 16, 2018 | |
| Rocky_linux | rocky-upgrade-python-nss-debugsourcerocky-upgrade-python-nss-docrocky-upgrade-python3-nssrocky-upgrade-python3-nss-debuginfo | Mar 12, 2024 | May 16, 2018 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-2_2-apisuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_2-apisuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-3_0-apisuse-upgrade-tomcat-servlet-3_1-apisuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Sep 14, 2018 | May 16, 2018 |
| Ubuntu | ubuntu-upgrade-libtomcat7-javaubuntu-upgrade-libtomcat8-javaubuntu-upgrade-tomcat7ubuntu-upgrade-tomcat8 | Jun 8, 2018 | May 16, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | May 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub