Orta CVSS 6.5

CVE-2018-1305: Tomcat: güvenlik açığı

Yayın: 24 Şubat 2018 02:29 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: %14,47 (yüzdelik 97)
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	7.0.0	7.0.84	—
apache-tomcat	8.0.0	8.0.49	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları