GitHub Advisoryadvisory · Maven
GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
CRITICAL
Official page ↗
- Aliases
- CVE-2018-8014
- Ecosystem
- Maven
- Packages
- org.apache.tomcat.embed:tomcat-embed-core
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1188
- Reviewed
- 2020-06-16
Affected packages
• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0.M1, < 9.0.9 → fixed in 9.0.9
• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.0, < 8.5.32 → fixed in 8.5.32
• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.0.0RC1, < 8.0.53 → fixed in 8.0.53
• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 7.0.41, < 7.0.88 → fixed in 7.0.88
Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Related
Alias · CVE (1)
- CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to… vulnerability
Weakness · CWE (1)
- CWE-1188 Initialization of a Resource with an Insecure Default weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014 advisory
- https://github.com/apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e web
- https://github.com/apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d web
- https://github.com/apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b web
- https://github.com/apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5 web
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E web
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html web
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html web
- https://seclists.org/bugtraq/2019/Dec/43 web
- https://security.netapp.com/advisory/ntap-20181018-0002 web
- https://usn.ubuntu.com/3665-1 web
- https://web.archive.org/web/20181017143233/http://www.securityfocus.com/bid/104203 web
- https://web.archive.org/web/20201207080723/http://www.securitytracker.com/id/1041888 web
- https://web.archive.org/web/20201207101131/http://www.securitytracker.com/id/1040998 web
- https://www.debian.org/security/2019/dsa-4596 web
- https://www.oracle.com/security-alerts/cpuapr2020.html web
- https://access.redhat.com/errata/RHSA-2018:2469 web
- https://access.redhat.com/errata/RHSA-2018:2470 web
- https://access.redhat.com/errata/RHSA-2018:3768 web
- https://access.redhat.com/errata/RHSA-2019:0450 web
- https://access.redhat.com/errata/RHSA-2019:0451 web
- https://access.redhat.com/errata/RHSA-2019:1529 web
- https://access.redhat.com/errata/RHSA-2019:2205 web
- https://github.com/advisories/GHSA-r4x2-3cq5-hqvp advisory