CVE-2017-5648 Exposure of Resource to Wrong Sphere in Apache Tomcat
CriticalCVSS 9.1
EPSS 13.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-catalina(Maven) | >= 9.0.0.M1, < 9.0.0.M18 | 9.0.0.M18 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M15 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M17 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | >= 8.5.0, < 8.5.13 | 8.5.13 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | >= 8.0.0, < 8.0.42 | 8.0.42 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.41 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | >= 7.0.0, < 7.0.76 | 7.0.76 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.75 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0.M1, < 9.0.0.M18 | 9.0.0.M18 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.5.0, < 8.5.13 | 8.5.13 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.0.0, < 8.0.42 | 8.0.42 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.0, < 7.0.76 | 7.0.76 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.63 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [users] 20170410 [SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosure mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- GLSA-201705-09 vendor-advisory
- security.netapp.com
- web.archive.org
- web.archive.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- github.com product
- RHSA-2017:1809 vendor-advisory
- RHSA-2017:1802 vendor-advisory
- RHSA-2017:1801 vendor-advisory
- DSA-3842 vendor-advisory
- DSA-3843 vendor-advisory
- [oss-security] 20200720 CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin mailing-list
- github.com
- 97530 third-party-advisory vdb-entry
- 1038220 vdb-entry
- Debian Security Tracker CVE-2017-5648 vendor-advisory