vulnwire
9.8crit

CVE-2018-8014in critical feed

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

Also known as GHSA-r4x2-3cq5-hqvp

Published 8 y ago · modified 22 d ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
20.9%
percentile 98%
Public exploits
0
none known

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
22 d ago

Exploit prediction (EPSS)

20.94% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat.embed:tomcat-embed-core
>=9.0.0.M1, <9.0.9
>=8.5.0, <8.5.32
>=8.0.0RC1, <8.0.53
>=7.0.41, <7.0.88
9.0.9
8.5.32
8.0.53
7.0.88

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-1188 Initialization of a Resource with an Insecure Default

References

  • tomcat.apache.org /security-9.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2019:0451 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • tomcat.apache.org /security-7.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:2469 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1041888 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • usn.ubuntu.com /3665-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • tomcat.apache.org /security-8.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:2470 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20181018-0002/ · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2019:0450 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2018/06/msg00008.html · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/104203 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1040998 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2018:3768 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2019:1529 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2019:2205 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.debian.org /debian-lts-announce/2019/08/msg00015.html · mailing-list, x_refsource_MLIST, x_transferred
  • debian.org /security/2019/dsa-4596 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • seclists.org /bugtraq/2019/Dec/43 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • lists.apache.org /thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-8014 · advisory
  • github.com /apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e · web
  • github.com /apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d · web
  • github.com /apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b · web
  • github.com /apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5 · web
  • lists.apache.org /thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.a · web
  • lists.apache.org /thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apach · web
  • security.netapp.com /advisory/ntap-20181018-0002 · web
  • usn.ubuntu.com /3665-1 · web
  • web.archive.org /web/20181017143233/http://www.securityfocus.com/bid/104203 · web
  • web.archive.org /web/20201207080723/http://www.securitytracker.com/id/1041888 · web
  • web.archive.org /web/20201207101131/http://www.securitytracker.com/id/1040998 · web
  • github.com /advisories/GHSA-r4x2-3cq5-hqvp · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.