CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
CriticalCVSS 9.8
EPSS 20.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0.M1, < 9.0.9 | 9.0.9 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.6 | No fix listed |
Show 127 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.7 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.5.0, < 8.5.32 | 8.5.32 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.31 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.0.0RC1, < 8.0.53 | 8.0.53 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.0-RC1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.0-RC10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.0-RC3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.0-RC5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.43 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.44 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.45 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.46 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.48 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.49 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.51 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.41, < 7.0.88 | 7.0.88 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.75 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.76 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.77 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.78 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.79 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.81 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.82 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.84 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.85 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.86 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0.M1, <= 9.0.8 | No fix listed |
| Apache Tomcat | = 9.0.0.M1 to 9.0.8 | No fix listed |
| Apache Tomcat | = 8.5.0 to 8.5.31 | No fix listed |
| Apache Tomcat | = 8.0.0.RC1 to 8.0.52 | No fix listed |
| Apache Tomcat | = 7.0.41 to 7.0.88 | No fix listed |
| apache tomcat | >= 7.0.41, <= 7.0.88 | No fix listed |
| apache tomcat | >= 8.0.0, <= 8.0.52 | No fix listed |
| apache tomcat | >= 8.5.0, <= 8.5.31 | No fix listed |
| apache tomcat | >= 9.0.0, <= 9.0.8 | No fix listed |
| apache tomcat | = 8.0.0-rc1 | No fix listed |
| apache tomcat | = 9.0.0-milestone1 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand unified manager | >= 9.4 | No fix listed |
| netapp oncommand unified manager | >= 7.3 | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp snapcenter server | All versions | No fix listed |
| netapp storage automation store | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- lists.apache.org
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update mailing-list third-party-advisory
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update mailing-list
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
- security.netapp.com patch third-party-advisory
- USN-3665-1 third-party-advisory vendor-advisory
- web.archive.org
- web.archive.org
- web.archive.org
- DSA-4596 vendor-advisory
- www.oracle.com
- RHSA-2018:2469 third-party-advisory vendor-advisory
- RHSA-2018:2470 third-party-advisory vendor-advisory
- RHSA-2018:3768 third-party-advisory vendor-advisory
- RHSA-2019:0450 third-party-advisory vendor-advisory
- RHSA-2019:0451 third-party-advisory vendor-advisory
- RHSA-2019:1529 vendor-advisory
- RHSA-2019:2205 vendor-advisory
- github.com vendor-advisory
- github.com product
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- tomcat.apache.org vendor-advisory
- tomcat.apache.org vendor-advisory
- tomcat.apache.org vendor-advisory
- www.oracle.com patch third-party-advisory
- 1041888 third-party-advisory vdb-entry
- 104203 third-party-advisory vdb-entry
- 1040998 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-8014 vendor-advisory