Skip to content
Log inStart free trial

GHSA-6rxj-58jh-436r CVE-2018-1304

Apache Tomcat unauthorized access vulnerability

Medium Maven
Severity
5.9 / 10
Medium · CVSS 3.0
Exploit chance (EPSS)
17.07%
Chance of exploitation in the next 30 days. Higher than 97.08% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
9.0.5
Upgrade org.apache.tomcat.embed:tomcat-embed-core to this version or later

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected versions

Maven

PackageVulnerableFixed in
org.apache.tomcat.embed:tomcat-embed-core
>= 9.0.0, < 9.0.5
9.0.5
org.apache.tomcat.embed:tomcat-embed-core
>= 8.5.0, < 8.5.28
8.5.28
org.apache.tomcat.embed:tomcat-embed-core
>= 8.0.0, < 8.0.51
8.0.51
org.apache.tomcat.embed:tomcat-embed-core
>= 7.0.0, < 7.0.86
7.0.86

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.tomcat.embed:tomcat-embed-core Maven → 9.0.5

maven
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>9.0.5</version></dependency>
gradle
implementation("org.apache.tomcat.embed:tomcat-embed-core:9.0.5")

Severity breakdown

CVSS 3.0 5.9

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-83qj-6fr2-vhqg
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Critical Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-qppj-fm5r-hxr3
HTTP/2 Stream Cancellation Attack
Medium Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-xjgh-84hx-56c5
Unrestricted Upload of File with Dangerous Type Apache Tomcat
High Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
CVE-2020-1938
Improper Privilege Management in Tomcat
Critical Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-pjfr-qf3p-3q25
When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
High Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-h3x4-894j-xpx5
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-f525-44xv-f2qj
Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor