CVE-2017-15706

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.

References

http://www.securityfocus.com/bid/103069

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cannounce.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://usn.ubuntu.com/3665-1/

Details

Source: MITRE

Published: 2018-01-31

Updated: 2019-04-15

Type: CWE-358

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM

Tenable Plugins

View all (19 total)

IDNameProductFamilySeverity
701338Apache Tomcat < 7.0.84 VulnerabilityNessus Network MonitorWeb Servers
medium
700704Apache Tomcat 9.0.x < 9.0.2 Insecure CGI Servlet Search Algorithm Description WeaknessNessus Network MonitorWeb Servers
medium
700692Apache Tomcat 8.5.x < 8.5.24 Insecure CGI Servlet Search Algorithm Description WeaknessNessus Network MonitorWeb Servers
medium
700686Apache Tomcat 8.0.45 < 8.0.48 Insecure CGI Servlet Search Algorithm Description WeaknessNessus Network MonitorWeb Servers
medium
700676Apache Tomcat 7.0.x < 7.0.84 Insecure CGI Servlet Search Algorithm Description WeaknessNessus Network MonitorWeb Servers
medium
112308Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description WeaknessWeb Application ScanningComponent Vulnerability
medium
112299Apache Tomcat 8.5.16 < 8.5.24 Insecure CGI Servlet Search Algorithm Description WeaknessWeb Application ScanningComponent Vulnerability
medium
112293Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description WeaknessWeb Application ScanningComponent Vulnerability
medium
110264Ubuntu 14.04 LTS / 16.04 LTS / 17.10 / 18.04 LTS : Tomcat vulnerabilities (USN-3665-1)NessusUbuntu Local Security Checks
critical
108742openSUSE Security Update : tomcat (openSUSE-2018-325)NessusSuSE Local Security Checks
medium
108598Amazon Linux AMI : tomcat80 (ALAS-2018-973)NessusAmazon Linux Local Security Checks
medium
106936Amazon Linux AMI : tomcat8 (ALAS-2018-959)NessusAmazon Linux Local Security Checks
medium
106914Fedora 26 : 1:tomcat (2018-ac2e276c76)NessusFedora Local Security Checks
medium
106713Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description WeaknessNessusWeb Servers
low
106712Apache Tomcat 8.5.16 < 8.5.24 Insecure CGI Servlet Search Algorithm Description WeaknessNessusWeb Servers
low
106711Apache Tomcat 8.0.45 < 8.0.48 Insecure CGI Servlet Search Algorithm Description WeaknessNessusWeb Servers
low
106710Apache Tomcat 7.0.79 < 7.0.83 Insecure CGI Servlet Search Algorithm Description WeaknessNessusWeb Servers
medium
106692Amazon Linux AMI : tomcat7 (ALAS-2018-947)NessusAmazon Linux Local Security Checks
medium
106634Fedora 27 : 1:tomcat (2018-0b48740047)NessusFedora Local Security Checks
medium