CVE-2018-8014

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Las opciones por defecto para el filtro CORS proporcionado en Apache Tomcat 9.0.0.M1 a 9.0.8, 8.5.0 a 8.5.31, 8.0.0.RC1 a 8.0.52 y 7.0.41 a 7.0.88 son inseguras y permiten "supportsCredentials" para todos los orígenes. Se espera que los usuarios del filtro CORS lo tengan configurado de forma adecuada para su entorno, en lugar de emplearlo con su configuración por defecto. Por lo tanto, se espera que la mayoría de usuarios no se vean afectados por este problema.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-03-09 CVE Reserved
2018-05-16 CVE Published
2024-08-05 CVE Updated
2024-11-09 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control
CWE-1188: Initialization of a Resource with an Insecure Default

CAPEC

References (41)

URL	Tag	Source
http://www.securityfocus.com/bid/104203	Third Party Advisory
http://www.securitytracker.com/id/1040998	Third Party Advisory
http://www.securitytracker.com/id/1041888	Third Party Advisory
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E	X_refsource_confirm
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html	Mailing List
https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html	Mailing List
https://seclists.org/bugtraq/2019/Dec/43	Mailing List
https://www.oracle.com/security-alerts/cpuapr2020.html	X_refsource_misc

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	2023-12-08
https://security.netapp.com/advisory/ntap-20181018-0002	2023-12-08

URL	Date	SRC
http://tomcat.apache.org/security-7.html	2023-12-08
http://tomcat.apache.org/security-8.html	2023-12-08
http://tomcat.apache.org/security-9.html	2023-12-08
https://access.redhat.com/errata/RHSA-2018:2469	2023-12-08
https://access.redhat.com/errata/RHSA-2018:2470	2023-12-08
https://access.redhat.com/errata/RHSA-2018:3768	2023-12-08
https://access.redhat.com/errata/RHSA-2019:0450	2023-12-08
https://access.redhat.com/errata/RHSA-2019:0451	2023-12-08
https://access.redhat.com/errata/RHSA-2019:1529	2023-12-08
https://access.redhat.com/errata/RHSA-2019:2205	2023-12-08
https://usn.ubuntu.com/3665-1	2023-12-08
https://www.debian.org/security/2019/dsa-4596	2023-12-08
https://access.redhat.com/security/cve/CVE-2018-8014	2019-08-06
https://bugzilla.redhat.com/show_bug.cgi?id=1579611	2019-08-06

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Netapp Search vendor "Netapp"	Oncommand Unified Manager Search vendor "Netapp" for product "Oncommand Unified Manager"	>= 7.3 Search vendor "Netapp" for product "Oncommand Unified Manager" and version " >= 7.3"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 7.0.41 <= 7.0.88 Search vendor "Apache" for product "Tomcat" and version " >= 7.0.41 <= 7.0.88"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 8.0.0 <= 8.0.52 Search vendor "Apache" for product "Tomcat" and version " >= 8.0.0 <= 8.0.52"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 8.5.0 <= 8.5.31 Search vendor "Apache" for product "Tomcat" and version " >= 8.5.0 <= 8.5.31"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 9.0.0 <= 9.0.8 Search vendor "Apache" for product "Tomcat" and version " >= 9.0.0 <= 9.0.8"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				8.0.0 Search vendor "Apache" for product "Tomcat" and version "8.0.0"		rc1		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone1		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				17.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "17.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04"		lts		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected
Netapp Search vendor "Netapp"		Oncommand Insight Search vendor "Netapp" for product "Oncommand Insight"				-		-		Affected
Netapp Search vendor "Netapp"		Oncommand Unified Manager Search vendor "Netapp" for product "Oncommand Unified Manager"				>= 9.4 Search vendor "Netapp" for product "Oncommand Unified Manager" and version " >= 9.4"		vmware_vsphere		Affected
Netapp Search vendor "Netapp"		Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation"				-		-		Affected
Netapp Search vendor "Netapp"		Snapcenter Server Search vendor "Netapp" for product "Snapcenter Server"				-		-		Affected
Netapp Search vendor "Netapp"		Storage Automation Store Search vendor "Netapp" for product "Storage Automation Store"				-		-		Affected