CVSS: 7.5EPSS: 90%CPEs: 82EXPL: 0CVE-2017-12616 – tomcat: Information Disclosure when using VirtualDirContext
https://notcve.org/view.php?id=CVE-2017-12616
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. Cuando se empleó un VirtualDirContext con Apache Tomcat en sus versiones 7.0.0 a 7.0.80 fue posible omitir las restricciones de seguridad o ver el código fuente de los archivos JSP para los recursos servidos por VirtualDirContext usando una petición especialmente manipulada. • http://www.securityfocus.com/bid/100897 http://www.securitytracker.com/id/1039393 https://access.redhat.com/errata/RHSA-2018:0465 https://access.redhat.com/errata/RHSA-2018:0466 https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org% • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 97%CPEs: 83EXPL: 8CVE-2017-12615 – Apache Tomcat on Windows Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Cuando se ejecuta Apache Tomcat en sus versiones 7.0.0 a 7.0.79 en Windows con HTTP PUT habilitado (por ejemplo, estableciendo el parámetro de inicialización de solo lectura del Default en "false") fue posible subir un archivo JSP al servidor mediante una petición especialmente manipulada. Este archivo JSP podría ser solicitado y cualquier código que contenga podría ser ejecutado por el servidor. A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. • https://www.exploit-db.com/exploits/42953 https://github.com/breaktoprotect/CVE-2017-12615 https://github.com/BeyondCy/CVE-2017-12615 https://github.com/1337g/CVE-2017-12615 https://github.com/zi0Black/POC-CVE-2017-12615-or-CVE-2017-12717 https://github.com/ianxtianxt/CVE-2017-12615 https://github.com/cyberharsh/Tomcat-CVE-2017-12615 https://github.com/w0x68y/CVE-2017-12615-EXP http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html http&# • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 161EXPL: 0CVE-2017-5664 – tomcat: Security constrained bypass in error page mechanism
https://notcve.org/view.php?id=CVE-2017-5664
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. • http://www.debian.org/security/2017/dsa-3891 http://www.debian.org/security/2017/dsa-3892 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.securityfocus.com/bid/98888 http://www.securitytracker.com/id/1038641 https://access.redhat.com • CWE-266: Incorrect Privilege Assignment CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 205EXPL: 0CVE-2017-5647 – tomcat: Incorrect handling of pipelined requests when send file was used
https://notcve.org/view.php?id=CVE-2017-5647
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. Un fallo en el manejo de las peticiones pipelinadas en Apache Tomcat 9.0.0.M1 a 9.0.0.M18, 8.5.0 a 8.5.12, 8.0.0.RC1 a 8.0.42, 7.0.0 a 7.0.76, Y 6.0.0 a 6.0.52, cuando se utilizó el archivo de envío, se pierde la solicitud de pipeline cuando se procesa el archivo de envío de la solicitud anterior completada. Esto podría resultar en respuestas que parecen ser enviadas para la solicitud incorrecta. • http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt http://www.debian.org/security/2017/dsa-3842 http://www.debian.org/security/2017/dsa-3843 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.securitytracker.com/id/1038218 https://access.redhat.com/errata/RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:2493 https://access.redhat.com/errata/RHSA-2017:2494 https://access.redhat&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 148EXPL: 0CVE-2017-5648 – tomcat: Calls to application listeners did not use the appropriate facade object
https://notcve.org/view.php?id=CVE-2017-5648
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Cuando se investigaba el error 60718, se observó que algunas llamadas a los oyentes de aplicaciones en Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 a 8.5.11, 8.0.0.RC1 a 8.0.41 y 7.0. 0 a 7,0.75 no utilizó el objeto de fachada adecuado. Cuando se ejecutaba una aplicación no confiable bajo un SecurityManager, era posible, por tanto, que esa aplicación no fiable retuviese una referencia al objeto de solicitud o respuesta y, por lo tanto, acceder y / o modificar la información asociada con otra aplicación web. A vulnerability was discovered in tomcat. • http://www.debian.org/security/2017/dsa-3842 http://www.debian.org/security/2017/dsa-3843 http://www.openwall.com/lists/oss-security/2020/07/20/8 http://www.securityfocus.com/bid/97530 http://www.securitytracker.com/id/1038220 https://access.redhat.com/errata/RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:1809 https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.or • CWE-668: Exposure of Resource to Wrong Sphere •