GHSA-372q-33vh-8mpc CVE-2017-15706

Inconsistent documentation in Apache Tomcat

Medium Maven

Severity: 5.3 / 10; Medium · CVSS 3.0
Exploit chance (EPSS): 6.08%; Chance of exploitation in the next 30 days. Higher than 93.41% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1068 Inconsistency Between Implementation and Documented Design; CWE-358 Improperly Implemented Security Check for Standard
Fix: 9.0.2; Upgrade org.apache.tomcat:tomcat to this version or later

Description

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.apache.tomcat:tomcat	`>= 9.0.0.M22, < 9.0.2`	`9.0.2`
org.apache.tomcat:tomcat	`>= 8.5.16, < 8.5.24`	`8.5.24`
org.apache.tomcat:tomcat	`>= 8.0.45, < 8.0.48`	`8.0.48`
org.apache.tomcat:tomcat	`>= 7.0.79, < 7.0.84`	`7.0.84`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.tomcat:tomcat Maven → `9.0.2`

maven

<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat</artifactId><version>9.0.2</version></dependency>

gradle

implementation("org.apache.tomcat:tomcat:9.0.2")

Severity breakdown

CVSS 3.0 5.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Weakness

CWE-1068: Inconsistency Between Implementation and Documented Design

The implementation of the product is not consistent with the design as described within the relevant documentation.

CWE-358: Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2017-15706

Packages

github.com/apache/tomcat

Timeline

May 14, 2022 Published
Mar 16, 2024 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability	High Known exploited	Also affects org.apache.tomcat:tomcat
GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied	Critical	Also affects org.apache.tomcat:tomcat
GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time	Low	Also affects org.apache.tomcat:tomcat
GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive	High	Also affects org.apache.tomcat:tomcat
GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user	Critical	Also affects org.apache.tomcat:tomcat

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor