601 lines
21 KiB
JSON
Raw Normal View History

2023-04-24 12:24:31 +02:00
{
"id": "CVE-2018-1305",
"sourceIdentifier": "security@apache.org",
"published": "2018-02-23T23:29:00.937",
"lastModified": "2023-11-07T02:55:56.873",
2023-04-24 12:24:31 +02:00
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
"value": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them."
},
{
"lang": "es",
"value": "Las restricciones de seguridad definidas por anotaciones en Servlets en Apache Tomcat 9.0.0.M1 a 9.0.4, 8.5.0 a 8.5.27, 8.0.0.RC1 a 8.0.49 y 7.0.0 a 7.0.84 solo se aplicaban una vez se haya cargado el Servlet. Debido a que las restricciones de seguridad definidas de esta forma se aplican al patr\u00f3n URL y a cualquier URL bajo ese punto, era posible (dependiendo del orden en el qe se cargan los Servlets) que no se aplicasen algunas restricciones de seguridad. Esto podr\u00eda haber expuesto recursos a los usuarios que no estaban autorizados a acceder a ellos."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"cvssMetricV2": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndIncluding": "7.0.84",
"matchCriteriaId": "0204E778-1E01-4781-8B75-B9246B2AFCCF"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndIncluding": "8.0.49",
"matchCriteriaId": "FF49B49E-FE51-4731-81F4-75489CEB5270"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4752862B-7D26-4285-B8A0-CF082C758353"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"matchCriteriaId": "58EA7199-3373-4F97-9907-3A479A02155E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F963D737-2E95-4D7C-92C7-DACF3F36D1E8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "2BBBC5EA-012C-4C5D-A61B-BAF134B300DA"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C6119C4-1200-4EBE-89AB-6AB755C6DE3A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*",
"matchCriteriaId": "34EB147F-4D0B-49D5-95DB-ED36F6ECA517"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*",
"matchCriteriaId": "E6A52BDB-1384-470D-9A45-2A5A3F6A9795"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*",
"matchCriteriaId": "50820930-F6F0-4BDC-90A5-CC54592A7970"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*",
"matchCriteriaId": "3A401718-6009-4BAB-AE21-D8CDC11BA28A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*",
"matchCriteriaId": "87C93F0D-3C87-4E53-9426-4E442279A616"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m14:*:*:*:*:*:*",
"matchCriteriaId": "D386FA01-80C5-44FA-8B4D-9A4321575929"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m15:*:*:*:*:*:*",
"matchCriteriaId": "A7084406-5F98-407C-AB0C-8FB49090DB84"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m16:*:*:*:*:*:*",
"matchCriteriaId": "23D299BF-CF9D-47AC-BFE3-EB8FB6ED85A2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m17:*:*:*:*:*:*",
"matchCriteriaId": "458707DD-0813-46A2-AF43-99E51001A252"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m18:*:*:*:*:*:*",
"matchCriteriaId": "FFD72BFB-A4BF-4AA3-A116-E03682FD6A3F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m19:*:*:*:*:*:*",
"matchCriteriaId": "5607C05A-3A02-4ECD-9485-3106D94C6017"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*",
"matchCriteriaId": "E99E2479-0701-45F8-A2E3-032FBECCE704"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m20:*:*:*:*:*:*",
"matchCriteriaId": "4FF53C5D-BE39-4A82-81A9-B754FBAE8974"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m21:*:*:*:*:*:*",
"matchCriteriaId": "6F1932C7-0D7C-4D0C-A0F7-BD4E78AAC9B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m22:*:*:*:*:*:*",
"matchCriteriaId": "A0E9EE78-020F-4EA3-BEC7-254571686559"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m23:*:*:*:*:*:*",
"matchCriteriaId": "5DF108E2-BBBA-41F4-B51F-E2DD56C4974E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m24:*:*:*:*:*:*",
"matchCriteriaId": "CE6B8ED0-01E6-4382-B1D9-DD00121EB656"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m25:*:*:*:*:*:*",
"matchCriteriaId": "99D7925D-A541-4AD8-B558-ED29000A4249"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m26:*:*:*:*:*:*",
"matchCriteriaId": "65338975-C706-45E1-BE75-D59192D8A9F2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m27:*:*:*:*:*:*",
"matchCriteriaId": "C4B76DFF-28CF-4FDC-9630-10EAE800525F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*",
"matchCriteriaId": "01633F5D-3C81-41B0-84B5-4EF5F58C50C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*",
"matchCriteriaId": "0A9F84CF-504C-4265-8DB3-1F108B7C3BFE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*",
"matchCriteriaId": "A8A9EBAD-79A9-4774-B2AA-7A45B36B5E63"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*",
"matchCriteriaId": "B4BD6F87-A60C-40DA-BDFB-8E7A7448F37E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*",
"matchCriteriaId": "4C828DCE-1C17-48B3-89F2-A461E00C9211"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*",
"matchCriteriaId": "6930A67B-C0D8-4CB0-BCC8-5F8448C60651"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*",
"matchCriteriaId": "C3D53D09-BDDC-4282-B7C7-34CC82476FDE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4355F36-B223-4819-8272-751EBB68782F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E5962DD4-006E-42F3-A0B0-A1787C0E9384"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B0D2EE9-1220-4A81-93E6-97FFD3960CFC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2F4ABA66-A344-43F1-98A0-4CD5D8728F0F"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.5.0",
"versionEndIncluding": "8.5.27",
"matchCriteriaId": "760F85D9-4F6A-479B-987A-A096F0EF888A"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2177A5E9-B260-499E-8D60-920679518425"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AEB446C9-1AC2-4D7D-83DE-08934DDFC8B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A2E3E923-E2AD-400D-A618-26ADF7F841A2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EE3A1A04-5AAE-40D9-842A-8B46211C5D95"
}
]
}
]
}
],
"references": [
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "http://www.securityfocus.com/bid/103144",
"source": "security@apache.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "http://www.securitytracker.com/id/1040428",
"source": "security@apache.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:0465",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:0466",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:1320",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2939",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2019:2205",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E",
"source": "security@apache.org"
2023-04-24 12:24:31 +02:00
},
{
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E",
2023-04-24 12:24:31 +02:00
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E",
2023-04-24 12:24:31 +02:00
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E",
2023-04-24 12:24:31 +02:00
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E",
2023-04-24 12:24:31 +02:00
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E",
2023-04-24 12:24:31 +02:00
"source": "security@apache.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html",
"source": "security@apache.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html",
"source": "security@apache.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html",
"source": "security@apache.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20180706-0001/",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://usn.ubuntu.com/3665-1/",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.debian.org/security/2018/dsa-4281",
"source": "security@apache.org",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"source": "security@apache.org"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"source": "security@apache.org",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"source": "security@apache.org"
}
]
}