Vulnerability identifier: #VU8697
Vulnerability risk: Low
Exploitation vector: Network
Exploit availability: No
Vendor: Apache Foundation
The vulnerability allows a remote attacker to conduct client and server side cache poisoning.
The weakness exists due to the failure to add an HTTP Vary header indicating that the response varies depending on Origin by the CORS Filter. A remote attacker can trick the victim to follow a specially crafted link and conduct client and server side cache poisoning.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks
The vulnerability is addressed in the following versions: 7.0.79, 8.0.45 and 8.5.16.
Vulnerable software versions
Apache Tomcat: 7.0.0 - 7.0.78, 8.0.0 - 8.0.44, 8.5.0 - 8.5.14
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?