vulnwire
6.5med

CVE-2018-1305

Apache Tomcat information exposure vulnerability

Also known as GHSA-jx6h-3fjx-cgv5

Published 8 y ago · modified 24 d ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
14.5%
percentile 97%
Public exploits
0
none known

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
24 d ago

Exploit prediction (EPSS)

14.47% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat.embed:tomcat-embed-core
>=9.0.0M1, <9.0.5
>=8.5.0, <8.5.28
>=7.0.0, <7.0.85
9.0.5
8.5.28
7.0.85

Affected products

  • Apache Software Foundation Apache Tomcat

References

  • securityfocus.com /bid/103144 · vdb-entry, x_refsource_BID, x_transferred
  • security.netapp.com /advisory/ntap-20180706-0001/ · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2018/dsa-4281 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:2939 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0465 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • usn.ubuntu.com /3665-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • access.redhat.com /errata/RHSA-2018:1320 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.debian.org /debian-lts-announce/2018/03/msg00004.html · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat · x_refsource_MISC, x_transferred
  • lists.debian.org /debian-lts-announce/2018/07/msg00044.html · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2018:0466 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.debian.org /debian-lts-announce/2018/06/msg00008.html · mailing-list, x_refsource_MLIST, x_transferred
  • securitytracker.com /id/1040428 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2019:2205 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-1305 · advisory
  • github.com /apache/tomcat/commit/2349801827f09fb6582a8afdeca704294106ad9a · web
  • github.com /apache/tomcat/commit/2aac69f694d42d9219eb27018b3da0ae1bdd73ab · web
  • github.com /apache/tomcat/commit/3e54b2a6314eda11617ff7a7b899c251e222b1a1 · web
  • github.com /apache/tomcat/commit/4d637bc3986e5d09b9363e2144b8ba74fa6eac3a · web
  • github.com /apache/tomcat/commit/c63b96d72cd39287e17b2ba698f4eee0ba508073 · web
  • github.com /apache/tomcat/commit/de6b4fd58b64828f374503b9ec76a12017b92895 · web
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apach · web
  • security.netapp.com /advisory/ntap-20180706-0001 · web
  • usn.ubuntu.com /3665-1 · web
  • web.archive.org /web/20200227030042/http://www.securityfocus.com/bid/103144 · web
  • web.archive.org /web/20200516094320/http://www.securitytracker.com/id/1040428 · web
  • github.com /apache/tomcat · package
  • lists.apache.org /thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.