Security restrictions bypass in Apache Tomcat - CVE-2018-1305

Vulnerability identifier: #VU10706

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1305

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to security constraints defined by annotations of Servlets are only applied once a Servlet had been loaded. A remote attacker can supply a specially crafted URL pattern and any URLs below that point, bypass security restrictions and gain unauthorised access to arbitrary resources.

Apache Tomcat
Amazon Linux AMI
Debian Linux
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Dell Support Assist Enterprise
EMC Cloud Tiering Appliance
Oracle Communications Instant Messaging Server
tomcat

Update to version 7.0.85, 9.0.5.

Dell Support Assist Enterprise - update to 4.00.06.00
tomcat - addressed in versions 7.0.85-1.el6, 8.0.50-1.fc26, 8.0.50-1.fc27
EMC Cloud Tiering Appliance - addressed in versions 13.0.0.2.29, 13.1.0.2.20

• https://tomcat.apache.org/security-7.html
• https://tomcat.apache.org/security-9.html

• Security restrictions bypass in Apache Tomcat
• Amazon Linux AMI update for tomcat7, tomcat8
• Amazon Linux AMI update for tomcat80
• Debian update for tomcat8
• Red Hat update for tomcat
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Fedora 27 update for tomcat
• Fedora 26 update for tomcat
• Fedora EPEL 6 update for tomcat
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server