Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
147 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
Recommended action: Upgrade to 7.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
Recommended action: Upgrade to 7.0.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
Recommended action: Upgrade to 7.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
Recommended action: Upgrade to 7.0.5; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
Recommended action: Upgrade to 6.0.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.229 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Apache Tomcat introduced workarounds to avoid being affected by this issue in versions 7.0.7, 6.0.32, and 5.5.33.
Recommended action: Upgrade to 7.0.7, 6.0.32 or 5.5.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
Recommended action: Upgrade to 9.0.0.M3, 8.0.32 or 7.0.68 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
Recommended action: Upgrade to 6.0.20, 5.5.28 or 4.1.40 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
Recommended action: Upgrade to 7.0.12, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
Recommended action: Upgrade to 7.0.12, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
Recommended action: Upgrade to 7.0.12, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
Recommended action: Upgrade to 7.0.19, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
Recommended action: Upgrade to 7.0.2, 6.0.28 or 5.5.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
Recommended action: Upgrade to 7.0.19, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
Recommended action: Upgrade to 7.0.12, 6.0.33 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Recommended action: Upgrade to 7.0.4, 6.0.30 or 5.5.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
Recommended action: Upgrade to 7.0.21, 6.0.34 or 5.5.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
Recommended action: Upgrade to 7.0.30 or 6.0.37 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Recommended action: Upgrade to 8.0.0-RC3 (pre-release), 7.0.47 or 6.0.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
Recommended action: Upgrade to 8.0.0-RC10 (pre-release), 7.0.50 or 6.0.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
Recommended action: Upgrade to 7.0.33 or 6.0.37 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.
Recommended action: Upgrade to 6.0.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or .tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Recommended action: Upgrade to 8.0.0-RC10 (pre-release), 7.0.50 or 6.0.39 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
Recommended action: Upgrade to 8.0.4, 7.0.53 or 6.0.40 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Recommended action: Upgrade to 8.0.6, 7.0.54 or 6.0.40 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.