CVE-2018-8014
CVSS V2 High 7.5
CVSS V3 Critical 9.8
Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Overview
- CVE ID
- CVE-2018-8014
- Assigner
- security@apache.org
- Vulnerability Status
- Modified
- Published Version
- 2018-05-16T16:29:00
- Last Modified Date
- 2019-10-03T00:03:26
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 1 | OR | 7.0.41 | 7.0.88 |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 1 | OR | 8.0.0 | 8.0.52 |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 1 | OR | 8.5.0 | 8.5.31 |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 1 | OR | 9.0.0 | 9.0.8 |
| cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:* | 1 | OR | ||
| AND | ||||
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 1 | OR | ||
| AND | ||||
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 1 | OR | ||
| AND | ||||
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | 1 | OR | 9.4 | |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* | 1 | OR | ||
| AND | ||||
| cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:* | 1 | OR | 7.3 | |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 7.5
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-8014 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:44:20 | Added to TrackCVE | |||
| 2022-12-03 06:15:42 | 2018-05-16T16:29Z | 2018-05-16T16:29:00 | CVE Published Date | updated |
| 2022-12-03 06:15:42 | 2019-10-03T00:03:26 | CVE Modified Date | updated | |
| 2022-12-03 06:15:42 | Modified | Vulnerability Status | updated |