Apache Software Foundation Apache Tomcat
En bref
- Source
- NVD
- EPSS
- EPSS 13.23 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Faiblesses (CWE)
- CWE-668 — Exposition d'une ressource à la mauvaise sphère
Références
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180614-0001/
- http://www.securityfocus.com/bid/97530
- https://access.redhat.com/errata/RHSA-2017:1801
- http://www.debian.org/security/2017/dsa-3843
- http://www.securitytracker.com/id/1038220
- http://www.debian.org/security/2017/dsa-3842
- https://access.redhat.com/errata/RHSA-2017:1809
- https://access.redhat.com/errata/RHSA-2017:1802
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- http://www.openwall.com/lists/oss-security/2020/07/20/8
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-3vx3-xf6q-r5xp — Exposure of Resource to Wrong Sphere in Apache Tomcat
Références européennes
- ENISA EUVD · EUVD-2022-2247
- GCVE · GCVE-0-2017-5648
Avis du CERT-FR
- CERTFR-2017-AVI-116 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*- +108 autres
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 9.0.0.M1 to 9.0.0.M17 ; affected 8.5.0 to 8.5.11 ; affected 8.0.0.RC1 to 8.0.41 ; affected 7.0.0 to 7.0.75 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |