#VU12798 Information disclosure in Apache Tomcat
Vulnerability identifier: #VU12798
Vulnerability risk: Low
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-200
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Apache Tomcat
Server applications /
Web servers
Vendor: Apache Foundation
Description
supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. A remote attacker can access important data.Mitigation
Update to version 8.0.53 or 8.5.32.
Update to version 9.0.9.
Vulnerable software versions
Apache Tomcat: 8.0.0 - 8.0.50, 8.5.0 - 8.5.28, 9.0.0-M1 - 9.0.5
External links
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
