Skip to content
Log inStart free trial

GHSA-jx6h-3fjx-cgv5 CVE-2018-1305

Apache Tomcat information exposure vulnerability

Medium Maven
Severity
6.5 / 10
Medium · CVSS 3.0
Exploit chance (EPSS)
14.47%
Chance of exploitation in the next 30 days. Higher than 96.63% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
9.0.5
Upgrade org.apache.tomcat.embed:tomcat-embed-core to this version or later

Description

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

Affected versions

Maven

PackageVulnerableFixed in
org.apache.tomcat.embed:tomcat-embed-core
>= 9.0.0M1, < 9.0.5
9.0.5
org.apache.tomcat.embed:tomcat-embed-core
>= 8.5.0, < 8.5.28
8.5.28
org.apache.tomcat.embed:tomcat-embed-core
>= 7.0.0, < 7.0.85
7.0.85

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.tomcat.embed:tomcat-embed-core Maven → 9.0.5

maven
<dependency><groupId>org.apache.tomcat.embed</groupId><artifactId>tomcat-embed-core</artifactId><version>9.0.5</version></dependency>
gradle
implementation("org.apache.tomcat.embed:tomcat-embed-core:9.0.5")

Severity breakdown

CVSS 3.0 6.5

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-83qj-6fr2-vhqg
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Critical Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-qppj-fm5r-hxr3
HTTP/2 Stream Cancellation Attack
Medium Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-xjgh-84hx-56c5
Unrestricted Upload of File with Dangerous Type Apache Tomcat
High Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
CVE-2020-1938
Improper Privilege Management in Tomcat
Critical Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-pjfr-qf3p-3q25
When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
High Known exploited Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-h3x4-894j-xpx5
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
GHSA-f525-44xv-f2qj
Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
Critical Also affects org.apache.tomcat.embed:tomcat-embed-core
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor