Kritik CVSS 9.8

CVE-2018-8014: Tomcat: güvenlik açığı

Yayın: 16 Mayıs 2018 19:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %20,94 (yüzdelik 98)
CWE: CWE-1188
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	7.0.41	7.0.88	—
apache-tomcat	8.0.0	8.0.52	—
apache-tomcat	8.5.0	8.5.31	—
apache-tomcat	9.0.0	9.0.8	—
apache-tomcat	8.0.0	8.0.0	—
apache-tomcat	9.0.0	9.0.0	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	17.10	17.10	—
canonical-ubuntu-linux	18.04	18.04	—
debian-debian-linux	8.0	8.0	—
netapp-oncommand-insight	—	—	—
netapp-oncommand-unified-manager	9.4	—	—
netapp-oncommand-workflow-automation	—	—	—
netapp-snapcenter-server	—	—	—
netapp-storage-automation-store	—	—	—
netapp-oncommand-unified-manager	7.3	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları