CVE-2018-8014
critical · 9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
9.8
CVSS
21.7%
EPSS (exploit prob.)
98th
EPSS percentile
2018-05-16
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1188
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | tomcat | >= 7.0.41, <= 7.0.88 |
| apache | tomcat | >= 8.0.0, <= 8.0.52 |
| apache | tomcat | >= 8.5.0, <= 8.5.31 |
| apache | tomcat | >= 9.0.0, <= 9.0.8 |
| apache | tomcat | 8.0.0 |
| apache | tomcat | 9.0.0 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 17.10 |
| canonical | ubuntu_linux | 18.04 |
| debian | debian_linux | 8.0 |
| netapp | oncommand_insight | all versions |
| netapp | oncommand_unified_manager | >= 9.4 |
| netapp | oncommand_workflow_automation | all versions |
| netapp | snapcenter_server | all versions |
| netapp | storage_automation_store | all versions |
| netapp | oncommand_unified_manager | >= 7.3 |
| microsoft | windows | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-9.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:2469
- https://access.redhat.com/errata/RHSA-2018:2470
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2019:0450
- https://access.redhat.com/errata/RHSA-2019:0451
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-8014