CVE-2018-1305medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
References
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/103144
http://www.securitytracker.com/id/1040428
https://access.redhat.com/errata/RHSA-2018:0465
https://access.redhat.com/errata/RHSA-2018:0466
https://access.redhat.com/errata/RHSA-2018:1320
https://access.redhat.com/errata/RHSA-2018:2939
https://access.redhat.com/errata/RHSA-2019:2205
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html
https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html
https://security.netapp.com/advisory/ntap-20180706-0001/
https://usn.ubuntu.com/3665-1/
https://www.debian.org/security/2018/dsa-4281
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Details
Source: MITRE
Published: 2018-02-23
Updated: 2019-10-03
Type: NVD-CWE-noinfo
Risk Information
CVSS v2
Base Score: 4
Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8
Severity: MEDIUM
CVSS v3
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 7.0.0 to 7.0.84 (inclusive)
Configuration 2
OR
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 8.0.0 to 8.0.49 (inclusive)
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
Configuration 3
OR
cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m14:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m15:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m16:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m17:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m18:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m19:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m20:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m21:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m22:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m23:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m24:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m25:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m26:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m27:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*
Configuration 4
OR
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from 8.5.0 to 8.5.27 (inclusive)
Configuration 5
OR
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Configuration 6
OR
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Configuration 7
OR
cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 134569 | Amazon Linux 2 : tomcat (ALAS-2020-1402) | Nessus | Amazon Linux Local Security Checks | critical |
| 132210 | EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2019-2675) | Nessus | Huawei Local Security Checks | high |
| 131853 | EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2019-2361) | Nessus | Huawei Local Security Checks | high |
| 129186 | EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2019-1992) | Nessus | Huawei Local Security Checks | high |
| 128376 | CentOS 7 : tomcat (CESA-2019:2205) | Nessus | CentOS Local Security Checks | critical |
| 128266 | Scientific Linux Security Update : tomcat on SL7.x x86_64 (20190806) | Nessus | Scientific Linux Local Security Checks | critical |
| 127697 | RHEL 7 : tomcat (RHSA-2019:2205) | Nessus | Red Hat Local Security Checks | critical |
| 700705 | Apache Tomcat 9.0.x < 9.0.5 Insecure CGI Servlet Search Algorithm Description Weakness | Nessus Network Monitor | Web Servers | medium |
| 700693 | Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness | Nessus Network Monitor | Web Servers | medium |
| 700687 | Apache Tomcat 8.0.x < 8.0.50 Security Constraint Weakness | Nessus Network Monitor | Web Servers | medium |
| 700677 | Apache Tomcat 7.0.x < 7.0.85 Security Constraint Weakness | Nessus Network Monitor | Web Servers | medium |
| 112307 | Apache Tomcat 7.0.0 < 7.0.85 Security Constraint Weakness | Web Application Scanning | Component Vulnerability | medium |
| 112298 | Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness | Web Application Scanning | Component Vulnerability | medium |
| 112292 | Apache Tomcat 9.0.0.M1 < 9.0.5 Security Constraint Weakness | Web Application Scanning | Component Vulnerability | medium |
| 112185 | Debian DSA-4281-1 : tomcat8 - security update | Nessus | Debian Local Security Checks | high |
| 111391 | Debian DLA-1450-1 : tomcat8 security update | Nessus | Debian Local Security Checks | medium |
| 111333 | Oracle Secure Global Desktop Multiple Vulnerabilities (July 2018 CPU) | Nessus | Misc. | critical |
| 110264 | Ubuntu 14.04 LTS / 16.04 LTS / 17.10 / 18.04 LTS : Tomcat vulnerabilities (USN-3665-1) | Nessus | Ubuntu Local Security Checks | critical |
| 108838 | Fedora 26 : 1:tomcat (2018-a233dae4ab) | Nessus | Fedora Local Security Checks | medium |
| 108837 | Fedora 27 : 1:tomcat (2018-50f0da5d38) | Nessus | Fedora Local Security Checks | medium |
| 108742 | openSUSE Security Update : tomcat (openSUSE-2018-325) | Nessus | SuSE Local Security Checks | medium |
| 108598 | Amazon Linux AMI : tomcat80 (ALAS-2018-973) | Nessus | Amazon Linux Local Security Checks | medium |
| 108597 | Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2018-972) | Nessus | Amazon Linux Local Security Checks | medium |
| 107208 | RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 2 (RHSA-2018:0466) | Nessus | Red Hat Local Security Checks | high |
| 107151 | Debian DLA-1301-1 : tomcat7 security update | Nessus | Debian Local Security Checks | medium |
| 107043 | FreeBSD : tomcat -- Security constraints ignored or applied too late (55c4233e-1844-11e8-a712-0025908740c2) | Nessus | FreeBSD Local Security Checks | medium |
| 106978 | Apache Tomcat 9.0.0.M1 < 9.0.5 Insecure CGI Servlet Search Algorithm Description Weakness | Nessus | Web Servers | low |
| 106977 | Apache Tomcat 8.5.x < 8.5.28 Security Constraint Weakness | Nessus | Web Servers | low |
| 106976 | Apache Tomcat 8.0.0.RC1 < 8.0.50 Security Constraint Weakness | Nessus | Web Servers | low |
| 106975 | Apache Tomcat 7.0.0 < 7.0.85 Security Constraint Weakness | Nessus | Web Servers | medium |