CVE-2018-1305 Apache Tomcat information exposure vulnerability
MediumCVSS 6.5
EPSS 14.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0M1, < 9.0.5 | 9.0.5 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.5.0, < 8.5.28 | 8.5.28 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.0 | No fix listed |
Show 132 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.0, < 7.0.85 | 7.0.85 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.75 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.76 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.77 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.78 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.79 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.81 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.82 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.84 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.5.0, <= 8.5.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.0, <= 7.0.84 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0M1, <= 9.0.4 | No fix listed |
| Apache Tomcat | = Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 | No fix listed |
| apache tomcat | >= 7.0.0, <= 7.0.84 | No fix listed |
| apache tomcat | >= 8.0.0, <= 8.0.49 | No fix listed |
| apache tomcat | = 8.0.0-rc1 | No fix listed |
| apache tomcat | = 8.0.0-rc10 | No fix listed |
| apache tomcat | = 8.0.0-rc3 | No fix listed |
| apache tomcat | = 8.0.0-rc5 | No fix listed |
| apache tomcat | = 9.0.0 | No fix listed |
| apache tomcat | = 9.0.0-milestone1 | No fix listed |
| apache tomcat | = 9.0.0-milestone10 | No fix listed |
| apache tomcat | = 9.0.0-milestone11 | No fix listed |
| apache tomcat | = 9.0.0-milestone12 | No fix listed |
| apache tomcat | = 9.0.0-milestone13 | No fix listed |
| apache tomcat | = 9.0.0-milestone14 | No fix listed |
| apache tomcat | = 9.0.0-milestone15 | No fix listed |
| apache tomcat | = 9.0.0-milestone16 | No fix listed |
| apache tomcat | = 9.0.0-milestone17 | No fix listed |
| apache tomcat | = 9.0.0-milestone18 | No fix listed |
| apache tomcat | = 9.0.0-milestone19 | No fix listed |
| apache tomcat | = 9.0.0-milestone2 | No fix listed |
| apache tomcat | = 9.0.0-milestone20 | No fix listed |
| apache tomcat | = 9.0.0-milestone21 | No fix listed |
| apache tomcat | = 9.0.0-milestone22 | No fix listed |
| apache tomcat | = 9.0.0-milestone23 | No fix listed |
| apache tomcat | = 9.0.0-milestone24 | No fix listed |
| apache tomcat | = 9.0.0-milestone25 | No fix listed |
| apache tomcat | = 9.0.0-milestone26 | No fix listed |
| apache tomcat | = 9.0.0-milestone27 | No fix listed |
| apache tomcat | = 9.0.0-milestone3 | No fix listed |
| apache tomcat | = 9.0.0-milestone4 | No fix listed |
| apache tomcat | = 9.0.0-milestone5 | No fix listed |
| apache tomcat | = 9.0.0-milestone6 | No fix listed |
| apache tomcat | = 9.0.0-milestone7 | No fix listed |
| apache tomcat | = 9.0.0-milestone8 | No fix listed |
| apache tomcat | = 9.0.0-milestone9 | No fix listed |
| apache tomcat | = 9.0.1 | No fix listed |
| apache tomcat | = 9.0.2 | No fix listed |
| apache tomcat | = 9.0.3 | No fix listed |
| apache tomcat | = 9.0.4 | No fix listed |
| apache tomcat | >= 8.5.0, <= 8.5.27 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| oracle fusion middleware | = 12.2.1.3.0 | No fix listed |
| oracle managed file transfer | = 12.1.3.0.0 | No fix listed |
| oracle managed file transfer | = 12.2.1.3.0 | No fix listed |
| oracle MICROS Relate CRM Software | = 11.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update mailing-list third-party-advisory
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update mailing-list third-party-advisory
- [debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- USN-3665-1 third-party-advisory vendor-advisory
- web.archive.org
- web.archive.org
- DSA-4281 third-party-advisory vendor-advisory
- www.oracle.com
- www.oracle.com patch third-party-advisory
- www.oracle.com
- RHSA-2018:0465 third-party-advisory vendor-advisory
- RHSA-2018:0466 third-party-advisory vendor-advisory
- RHSA-2018:1320 third-party-advisory vendor-advisory
- RHSA-2018:2939 third-party-advisory vendor-advisory
- RHSA-2019:2205 vendor-advisory
- github.com product
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- github.com
- 103144 third-party-advisory vdb-entry
- 1040428 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-1305 vendor-advisory