Version 11.0.2
tomcat-embed-core
Core Tomcat implementation
Install Instructions
mvn install tomcat-embed-core
Language Java
Package URL (purl) pkg:maven/org.apache.tomcat.embed:tomcat-embed-core@11.0.2
Find tomcat-embed-core vulnerabilities in your supply chain.
tomcat-embed-core Vulnerabilities
Sort by
CVE (Latest)
CVE (Latest)
-
CVE (Latest)
-
CVE (Oldest)
-
CVSS Score (Highest)
-
CVSS Score (Lowest)
CVE  |
CVSS Score |
CWE(s) |
EPSS Score |
EPSS % |
Impacted Versions |
|---|---|---|---|---|---|
| CVE-2011-1088 | Medium 5.4 | CWE-284 | 0.00232 | 0.60904 |
|
| CVE-2011-1184 | Medium 5.3 | CWE-264 | 0.00181 | 0.55497 |
|
| CVE-2011-1419 | Medium 5.4 | CWE-284 | 0.00197 | 0.57335 |
|
| CVE-2011-1475 | Medium 5.3 | CWE-20 | 0.00548 | 0.7729 |
|
| CVE-2011-2204 | Low 3.3 | CWE-200 | 0.00045 | 0.17761 |
|
| CVE-2011-2481 | Medium 5.9 | CWE-284 | 0.00044 | 0.11839 |
|
| CVE-2011-2526 | Medium 5.3 | CWE-20 | 0.00046 | 0.18904 |
|
| CVE-2011-3375 | Medium 5.3 | CWE-200 | 0.0025 | 0.64038 |
|
| CVE-2011-3376 | Medium 5.3 | CWE-264 | 0.00042 | 0.04956 |
|
| CVE-2011-4858 | Medium 5.3 | CWE-399 | 0.80925 | 0.98577 |
|
| CVE-2011-5062 | Medium 5.3 | CWE-264 | 0.00181 | 0.55497 |
|
| CVE-2011-5063 | Medium 4.3 | CWE-287 | 0.0036 | 0.71915 |
|
| CVE-2011-5064 | Medium 4.3 | CWE-310 | 0.00321 | 0.70238 |
|
| CVE-2012-0022 | Medium 5.3 | CWE-189 | 0.12966 | 0.95493 |
|
| CVE-2012-3546 | Medium 4.3 | CWE-264 | 0.00291 | 0.6861 |
|
| CVE-2012-4431 | Medium 4.3 | CWE-264 | 0.00121 | 0.46816 |
|
| CVE-2012-5885 | Medium 5.3 | CWE-264 | 0.0017 | 0.54272 |
|
| CVE-2012-5886 | Medium 5.3 | CWE-287 | 0.00403 | 0.7335 |
|
| CVE-2012-5887 | Medium 5.3 | CWE-287 | 0.00403 | 0.7335 |
|
| CVE-2013-2067 | Medium 6.3 | CWE-287 | 0.01464 | 0.86436 |
|
| CVE-2013-2071 | Low 3.7 | CWE-200 | 0.00471 | 0.75342 |
|
| CVE-2013-2185 | High 7.3 | CWE-20, CWE-94 | 0.00345 | 0.7134 |
|
| CVE-2013-4444 | High 7.3 | CWE-20, CWE-94 | 0.08074 | 0.94297 |
|
| CVE-2013-4590 | Medium 4.3 | CWE-200 | 0.00597 | 0.78253 |
|
| CVE-2014-0096 | Medium 4.3 | CWE-264 | 0.00126 | 0.47718 |
|
| CVE-2014-0119 | Medium 4.3 | CWE-264 | 0.00167 | 0.53772 |
|
| CVE-2014-0227 | Medium 6.5 | CWE-19 | 0.95237 | 0.99514 |
|
| CVE-2014-0230 | High 7.5 | CWE-399 | 0.07366 | 0.94034 |
|
| CVE-2014-7810 | Medium 5.3 | CWE-284 | 0.00331 | 0.70706 |
|
| CVE-2015-5174 | Medium 4.3 | CWE-22 | 0.00234 | 0.61011 |
|
| CVE-2015-5346 | High 8.1 | CWE-384, CWE-200 | 0.00942 | 0.82877 |
|
| CVE-2015-5345 | Medium 5.3 | CWE-22 | 0.0052 | 0.76666 |
|
| CVE-2016-0706 | Medium 4.3 | CWE-200 | 0.00726 | 0.80477 |
|
| CVE-2016-0714 | High 8.8 | CWE-264 | 0.00561 | 0.77526 |
|
| CVE-2016-0762 | Medium 5.9 | CWE-264 | 0.00324 | 0.70386 |
|
| CVE-2016-0763 | Medium 6.3 | CWE-264, CWE-284 | 0.0034 | 0.71114 |
|
| CVE-2016-3092 | High 7.5 | CWE-20 | 0.29976 | 0.96922 |
|
| CVE-2016-6797 | High 7.5 | CWE-284 | 0.00324 | 0.70386 |
|
| CVE-2016-6816 | High 7.1 | CWE-20 | 0.00786 | 0.81271 |
|
| CVE-2016-8735 | High 9.8 | CWE-284 | 0.9501 | 0.99483 |
|
| CVE-2016-8745 | High 7.5 | CWE-388 | 0.01456 | 0.8641 |
|
| CVE-2017-12615 | High 8.1 | CWE-434 | 0.96554 | 0.99739 |
|
| CVE-2017-5648 | High 9.1 | CWE-668, CWE-284 | 0.00871 | 0.8218 |
|
| CVE-2017-5647 | High 7.5 | CWE-200 | 0.00283 | 0.68202 |
|
| CVE-2017-5664 | High 7.5 | CWE-755 | 0.0097 | 0.83161 |
|
| CVE-2018-1304 | Medium 5.9 | CWE-284 | 0.0048 | 0.75538 |
|
| CVE-2018-1305 | Medium 6.5 | CWE-22 | 0.00154 | 0.52119 |
|
| CVE-2019-0221 | Medium 6.1 | CWE-79 | 0.0212 | 0.88877 |
|
| CVE-2019-0232 | High 8.1 | CWE-78 | 0.97365 | 0.99957 |
|
| CVE-2019-12418 | High 7 | CWE-522 | 0.00049 | 0.20124 |
|
| CVE-2019-17563 | High 7.5 | CWE-384 | 0.00494 | 0.75965 |
|
| CVE-2020-1935 | Medium 4.8 | CWE-444 | 0.00732 | 0.80563 |
|
| CVE-2020-1938 | High 9.8 | CWE-269 | 0.97422 | 0.99969 |
|
| CVE-2020-9484 | High 7 | CWE-502 | 0.93186 | 0.99287 |
|
| CVE-2021-24122 | Medium 5.9 | CWE-706, CWE-200 | 0.00255 | 0.64502 |
|
| CVE-2021-25329 | High 7 | 0.00046 | 0.17935 |
|
|
| CVE-2010-3718 | Low 2.9 | CWE-22 | 0.00163 | 0.53307 |
|
| CVE-2010-4172 | Medium 4.3 | CWE-79 | 0.16569 | 0.95995 |
|
| CVE-2011-0013 | Medium 4.3 | CWE-79 | 0.0127 | 0.85394 |
|
| CVE-2011-1183 | Medium 5.4 | CWE-284 | 0.00226 | 0.60403 |
|
| CVE-2011-1582 | Medium 4.3 | CWE-264 | 0.00354 | 0.7169 |
|
| CVE-2018-11784 | Medium 4.3 | CWE-601 | 0.89195 | 0.98985 |
|
| CVE-2018-1336 | High 7.5 | CWE-835 | 0.01785 | 0.8775 |
|
| CVE-2018-8034 | High 7.5 | CWE-295 | 0.00563 | 0.77595 |
|
| CVE-2018-8014 | High 9.8 | CWE-1188 | 0.14808 | 0.95769 |
|
| CVE-2014-0095 | Medium 5 | CWE-20 | 0.10655 | 0.95036 |
|
| CVE-2017-12617 | High 8.1 | CWE-434 | 0.97327 | 0.99949 |
|
| CVE-2016-6794 | Medium 5.3 | CWE-200 | 0.00213 | 0.58898 |
|
| CVE-2019-0199 | High 7.5 | CWE-400 | 0.23425 | 0.96582 |
|
| CVE-2016-6817 | High 7.5 | CWE-119 | 0.01651 | 0.87225 |
|
| CVE-2016-8747 | High 7.5 | CWE-200 | 0.00333 | 0.70804 |
|
| CVE-2017-5650 | High 7.5 | CWE-404, CWE-399 | 0.6356 | 0.97999 |
|
| CVE-2017-5651 | High 9.8 | CWE-19 | 0.00613 | 0.78521 |
|
| CVE-2017-7675 | High 7.5 | CWE-22 | 0.0054 | 0.77104 |
|
| CVE-2019-10072 | High 7.5 | CWE-667 | 0.1698 | 0.9604 |
|
| CVE-2021-43980 | Low 3.7 | CWE-362 | 0.00149 | 0.51334 |
|
| CVE-2022-42252 | High 7.5 | CWE-20, CWE-444 | 0.0024 | 0.61513 |
|
| CVE-2023-24998 | High 7.5 | CWE-770 | 0.01602 | 0.87041 |
|
| CVE-2023-41080 | Medium 6.1 | CWE-601 | 0.00383 | 0.72745 |
|
| CVE-2023-42795 | Medium 5.3 | CWE-459 | 0.01433 | 0.86314 |
|
| CVE-2023-45648 | Medium 5.3 | CWE-20 | 0.00447 | 0.74731 |
|
| CVE-2023-46589 | High 7.5 | CWE-444 | 0.00784 | 0.81229 |
|
| CVE-2024-24549 | High 7.5 | CWE-20 | 0.00045 | 0.15737 |
|
| CVE-2024-34750 | High 7.5 | CWE-755, CWE-400 | 0.00043 | 0.10859 |
|
| CVE-2018-8037 | Medium 5.9 | CWE-362 | 0.004 | 0.73272 |
|
| CVE-2020-13934 | High 7.5 | CWE-476, CWE-401, CWE-119 | 0.92568 | 0.9923 |
|
| CVE-2020-17527 | High 7.5 | CWE-200 | 0.00255 | 0.64482 |
|
| CVE-2021-25122 | High 7.5 | CWE-200 | 0.00191 | 0.56678 |
|
| CVE-2023-44487 | High 7.5 | CWE-400 | 0.81393 | 0.9859 |
|
| CVE-2024-21733 | Medium 5.3 | CWE-209 | 0.00488 | 0.75806 |
|
| CVE-2019-17569 | Medium 4.8 | CWE-444 | 0.0035 | 0.71545 |
|
| CVE-2023-28709 | High 7.5 | CWE-193 | 0.02455 | 0.8971 |
|
| CVE-2022-45143 | High 7.5 | CWE-116, CWE-74 | 0.00275 | 0.677 |
|
| CVE-2023-34981 | High 7.5 | CWE-732 | 0.00281 | 0.68023 |
|
| CVE-2024-52317 | Medium 6.5 | CWE-326 | 0.00043 | 0.10859 |
|
tomcat-embed-core Vulnerability Remediation Guidance
| CVE | Description | Full list of Impacted Versions | Fix |
|---|---|---|---|
| CVE-2024-52317 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue. | 11.0.0-M25, 9.0.93, 9.0.95, 10.1.30, 11.0.0-M26, 9.0.94, 10.1.29, 10.1.28 (Show all) | Major → 11.0.0 |
| CVE-2024-34750 | Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 9.0.0.M10, 9.0.0.M8, 9.0.0.M3, 9.0.0.M6, 9.0.0.M4 (Show all) | Patch → 9.0.90 |
| CVE-2024-24549 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2024-21733 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. | 8.5.9, 8.5.13, 8.5.20, 8.5.19, 8.5.8, 8.5.15, 8.5.21, 8.5.16 (Show all) | Patch → 8.5.99 |
| CVE-2023-46589 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2023-45648 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | 8.5.3, 8.5.0, 8.5.5, 8.5.4, 8.5.6, 8.5.2, 8.5.9, 8.5.13 (Show all) | Patch → 8.5.99 |
| CVE-2023-42795 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2023-41080 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2023-34981 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak. | 11.0.0-M5, 10.1.8, 9.0.74 | Patch → 11.0.0-M21 |
| CVE-2023-28709 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. | 9.0.71, 9.0.73, 10.1.5, 9.0.72, 10.1.6, 11.0.0-M4, 11.0.0-M3, 10.1.7 | Patch → 9.0.90 |
| CVE-2023-24998 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 9.0.0.M10, 9.0.0.M8, 9.0.0.M3, 9.0.0.M6, 9.0.0.M4 (Show all) | Patch → 9.0.90 |
| CVE-2022-45143 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. | 9.0.59, 9.0.64, 9.0.63, 9.0.65, 9.0.52, 9.0.56, 9.0.62, 10.1.0 (Show all) | Patch → 9.0.90 |
| CVE-2022-42252 | If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2021-43980 | The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2021-25329 | The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2021-25122 | When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. | 8.5.3, 8.5.0, 8.5.5, 8.5.4, 8.5.6, 8.5.2, 8.5.9, 8.5.13 (Show all) | Patch → 8.5.99 |
| CVE-2021-24122 | When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2020-9484 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2020-1935 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2020-17527 | While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. | 8.5.3, 8.5.0, 8.5.5, 8.5.4, 8.5.6, 8.5.2, 8.5.9, 8.5.13 (Show all) | Patch → 8.5.99 |
| CVE-2020-13934 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. | 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.5, 9.0.0.M10, 9.0.0.M8, 8.5.4, 8.5.6 (Show all) | Patch → 9.0.90 |
| CVE-2019-17569 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. | 9.0.30, 9.0.29, 8.5.50, 7.0.99, 8.5.49 | Patch → 9.0.90 |
| CVE-2019-17563 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2019-12418 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2019-10072 | The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2019-0232 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/). | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2019-0221 | The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2019-0199 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. | 8.0.3, 8.0.1, 8.0.14, 8.0.28, 8.0.27, 8.0.26, 8.0.5, 8.0.11 (Show all) | Minor → 8.5.99 |
| CVE-2018-8037 | If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. | 9.0.0.M9, 9.0.0.M11, 8.5.5, 9.0.0.M10, 8.5.6, 9.0.0.M22, 9.0.0.M18, 8.5.9 (Show all) | Patch → 9.0.90 |
| CVE-2018-8034 | The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88. | 7.0.40, 7.0.47, 7.0.35, 8.0.3, 7.0.37, 7.0.39, 7.0.42, 8.0.1 (Show all) | Patch → 7.0.107 |
| CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. | 7.0.47, 8.0.0-RC10, 8.0.3, 8.0.0-RC1, 7.0.42, 8.0.0-RC5, 8.0.1, 8.0.0-RC3 (Show all) | Patch → 7.0.107 |
| CVE-2018-1336 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. | 7.0.28, 7.0.30, 7.0.29, 7.0.40, 7.0.47, 7.0.32, 7.0.35, 8.0.0-RC10 (Show all) | Patch → 7.0.107 |
| CVE-2018-1305 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2018-1304 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2018-11784 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. | 7.0.28, 7.0.30, 7.0.29, 7.0.23, 7.0.27, 7.0.26, 7.0.25, 7.0.40 (Show all) | Patch → 7.0.107 |
| CVE-2017-7675 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2017-5664 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2017-5651 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2017-5650 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2017-5648 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2017-5647 | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2017-12617 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. | 8.0.0-RC10, 8.0.3, 8.0.0-RC1, 8.0.0-RC5, 8.0.1, 8.0.0-RC3, 9.0.0.M1, 8.0.14 (Show all) | Major → 8.5.99 |
| CVE-2017-12615 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-8747 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 9.0.0.M10, 9.0.0.M8, 9.0.0.M3, 9.0.0.M6, 9.0.0.M4 (Show all) | Patch → 9.0.90 |
| CVE-2016-8745 | A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-6817 | The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. | 9.0.0.M1, 9.0.0.M9, 9.0.0.M11, 8.5.3, 8.5.0, 8.5.5, 9.0.0.M10, 9.0.0.M8 (Show all) | Patch → 9.0.90 |
| CVE-2016-6816 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-6797 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-6794 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. | 8.0.3, 8.0.1, 9.0.0.M1, 8.0.14, 8.0.28, 8.0.27, 8.0.26, 8.0.5 (Show all) | Minor → 8.5.99 |
| CVE-2016-3092 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-0763 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-0762 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-0714 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2016-0706 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2015-5346 | Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2015-5345 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2015-5174 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-7810 | The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-0230 | Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-0227 | java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-0119 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-0096 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2014-0095 | java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing. | 8.0.0-RC10, 8.0.3, 8.0.0-RC1, 8.0.0-RC5, 8.0.1, 8.0.0-RC3 | Major → 8.5.99 |
| CVE-2013-4590 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2013-4444 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2013-2185 | ** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2013-2071 | java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2013-2067 | java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-5887 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-5886 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-5885 | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-4431 | org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-3546 | org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2012-0022 | Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-5064 | DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-5063 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-5062 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-4858 | Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-3376 | org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-3375 | Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-2526 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-2481 | Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.12 (Show all) | Patch → 7.0.107 |
| CVE-2011-2204 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0, 7.0.16 (Show all) | Patch → 7.0.107 |
| CVE-2011-1582 | Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419. | 7.0.12 | Patch → 7.0.107 |
| CVE-2011-1475 | The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users." | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-1419 | Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. | 7.0.8, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-1184 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values. | 7.0.8, 7.0.2, 7.0.11, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-1183 | Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419. | 7.0.11 | Patch → 7.0.107 |
| CVE-2011-1088 | Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. | 7.0.8, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.0 | Patch → 7.0.107 |
| CVE-2011-0013 | Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. | 7.0.2, 7.0.4, 7.0.5, 7.0.0 | Patch → 7.0.107 |
| CVE-2010-4172 | Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. | 7.0.2, 7.0.4, 7.0.0 | Patch → 7.0.107 |
| CVE-2010-3718 | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. | 7.0.2, 7.0.0 | Patch → 7.0.107 |
Instantly see if these tomcat-embed-core vulnerabilities affect your code.
Dependencies
Packages using versions of tomcat-embed-core affected by its vulnerabilities
| Dependent Packages |
|---|
| org.apache.tomcat:tomcat-annotations-api:11.0.2 |