CVE-2017-7674

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

References

http://www.debian.org/security/2017/dsa-3974

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.securityfocus.com/bid/100280

https://access.redhat.com/errata/RHSA-2017:1801

https://access.redhat.com/errata/RHSA-2017:1802

https://access.redhat.com/errata/RHSA-2017:3081

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cannounce.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E

https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html

https://security.netapp.com/advisory/ntap-20180614-0003/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us

Details

Source: MITRE

Published: 2017-08-11

Updated: 2019-04-15

Type: CWE-345

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:7.0.78:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.40:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.41:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.42:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.43:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.0.44:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m18:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m19:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m20:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m21:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*

Tenable Plugins

View all (26 total)

IDNameProductFamilySeverity
700702Apache Tomcat 9.0.x < 9.0.0.M22 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
700691Apache Tomcat 8.5.x < 8.5.16 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
700685Apache Tomcat 8.0.x < 8.0.45 Cache PoisoningNessus Network MonitorWeb Servers
medium
700673Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning VulnerabilityNessus Network MonitorWeb Servers
medium
112311Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning VulnerabilityWeb Application ScanningComponent Vulnerability
medium
112301Apache Tomcat 8.5.x < 8.5.16 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
high
112295Apache Tomcat 9.0.0.M1 < 9.0.0.M22 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
high
112177RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 1 (RHSA-2017:1801)NessusRed Hat Local Security Checks
critical
105687Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : tomcat7, tomcat8 vulnerabilities (USN-3519-1)NessusUbuntu Local Security Checks
critical
104765openSUSE Security Update : tomcat (openSUSE-2017-1299)NessusSuSE Local Security Checks
high
104287EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1262)NessusHuawei Local Security Checks
high
104286EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1261)NessusHuawei Local Security Checks
high
104269Scientific Linux Security Update : tomcat on SL7.x (noarch) (20171030)NessusScientific Linux Local Security Checks
high
104257CentOS 7 : tomcat (CESA-2017:3081)NessusCentOS Local Security Checks
high
104251RHEL 7 : tomcat (RHSA-2017:3081)NessusRed Hat Local Security Checks
high
104248Oracle Linux 7 : tomcat (ELSA-2017-3081)NessusOracle Linux Local Security Checks
high
103600Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-903)NessusAmazon Linux Local Security Checks
medium
103259Debian DSA-3974-1 : tomcat8 - security updateNessusDebian Local Security Checks
high
103235Fedora 26 : 1:tomcat (2017-ab0def38cd)NessusFedora Local Security Checks
medium
103234Fedora 25 : 1:tomcat (2017-a00a087fd4)NessusFedora Local Security Checks
medium
102590Apache Tomcat 9.0.0M1 < 9.0.0.M22 Multiple VulnerabilitiesNessusWeb Servers
high
102589Apache Tomcat 8.5.x < 8.5.16 Multiple VulnerabilitiesNessusWeb Servers
high
102588Apache Tomcat 8.0.0.RC1 < 8.0.45 Cache PoisoningNessusWeb Servers
medium
102587Apache Tomcat 7.0.41 < 7.0.79 Cache Poisoning VulnerabilityNessusWeb Servers
medium
102547Amazon Linux AMI : tomcat7 (ALAS-2017-873)NessusAmazon Linux Local Security Checks
critical
102177Amazon Linux AMI : tomcat8 (ALAS-2017-862)NessusAmazon Linux Local Security Checks
high