Düşük
CVE-2013-4590: Tomcat: hassas bilgi ifşası
Açıklama (NVD)
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Özet bilgiler
- Ürün
- Apache Tomcat
- EPSS
- %9,49 (yüzdelik 95)
- CWE
- CWE-200
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| apache-tomcat | 8.0.0 | 8.0.0 | — |
| debian-debian-linux | 7.0 | 7.0 | — |
| apache-tomcat | — | 6.0.37 | — |
| apache-tomcat | 1.1.3 | 1.1.3 | — |
| apache-tomcat | 3.0 | 3.0 | — |
| apache-tomcat | 3.1 | 3.1 | — |
| apache-tomcat | 3.1.1 | 3.1.1 | — |
| apache-tomcat | 3.2 | 3.2 | — |
| apache-tomcat | 3.2.1 | 3.2.1 | — |
| apache-tomcat | 3.2.2 | 3.2.2 | — |
| apache-tomcat | 3.2.2 | 3.2.2 | — |
| apache-tomcat | 3.2.3 | 3.2.3 | — |
| apache-tomcat | 3.2.4 | 3.2.4 | — |
| apache-tomcat | 3.3 | 3.3 | — |
| apache-tomcat | 3.3.1 | 3.3.1 | — |
| apache-tomcat | 3.3.1a | 3.3.1a | — |
| apache-tomcat | 3.3.2 | 3.3.2 | — |
| apache-tomcat | 4 | 4 | — |
| apache-tomcat | 4.0.0 | 4.0.0 | — |
| apache-tomcat | 4.0.1 | 4.0.1 | — |
| apache-tomcat | 4.0.2 | 4.0.2 | — |
| apache-tomcat | 4.0.3 | 4.0.3 | — |
Kaynaklar
- NVD kaydı
- advisories.mageia.org
- marc.info
- secunia.com
- secunia.com
- secunia.com
- secunia.com
- svn.apache.org
- svn.apache.org
- svn.apache.org
- tomcat.apache.org
- tomcat.apache.org
- tomcat.apache.org
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- www.debian.org
- www.mandriva.com
- www.mandriva.com
- www.oracle.com
- www.oracle.com
- www.securityfocus.com
- www.vmware.com
- bugzilla.redhat.com
- CWE-200