Orta CVSS 5.9

CVE-2018-1304: Tomcat: güvenlik açığı

Yayın: 28 Şubat 2018 23:29 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %17,07 (yüzdelik 97)
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	7.0.0	7.0.84	—
apache-tomcat	8.0.0	8.0.49	—
apache-tomcat	8.5.0	8.5.27	—
apache-tomcat	9.0.0	9.0.4	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları