CVE-2018-1304
טרם דורגה
תיאור (מקור, אנגלית)
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
מדדים
- EPSS — סבירות ניצול
- 17% (אחוזון 100) נכון ל-20/10/2026
מוצרים מושפעים
apache: tomcat; redhat: jboss enterprise application platform; redhat: jboss enterprise web server; redhat: enterprise linux; debian: debian linux; canonical: ubuntu linux; oracle: fusion middleware; oracle: hospitality guest access; oracle: micros relate crm software; oracle: secure global desktop; redhat: jboss middleware
קישורים
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/ PatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/ PatchThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
- http://www.securityfocus.com/bid/103170 Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040427 Third Party AdvisoryVDB Entry