#VU12798 Information disclosure in Apache Tomcat - CVE-2018-8014
Vulnerability identifier: #VU12798
Vulnerability risk: Low
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-200
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Apache Tomcat
Server applications /
Web servers
Vendor: Apache Foundation
Description
supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. A remote attacker can access important data.Mitigation
Update to version 8.0.53 or 8.5.32.
Update to version 9.0.9.
Vulnerable software versions
Apache Tomcat: 8.0.0 - 8.0.50, 8.5.0 - 8.5.28, 9.0.0-M1 - 9.0.5
External links
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
