CVEvulnerability

CVE-2018-1304

5.9 MEDIUM Published 2018-02-28 Modified 2026-10-15 Official page ↗
Status
Modified
Published
2018-02-28
Last modified
2026-10-15
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected configurations

• apache tomcat (>= 7.0.0 <= 7.0.84) • apache tomcat (>= 8.0.0 <= 8.0.49) • apache tomcat (>= 8.5.0 <= 8.5.27) • apache tomcat (>= 9.0.0 <= 9.0.4) • apache tomcat 8.0.0 • apache tomcat 9.0.0 • redhat jboss enterprise application platform 6 • redhat jboss enterprise application platform 6.4 • redhat jboss enterprise web server 3.0.0 • debian debian linux 7.0 • debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 17.10 • canonical ubuntu linux 18.04 • oracle fusion middleware 12.2.1.3.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle micros relate crm software 11.4 • oracle secure global desktop 5.3 • oracle secure global desktop 5.4 • redhat jboss middleware 1

References