CVE-2018-1304

Impact:
Moderate
Public Date:
2018-01-31
CWE:
CWE-284
Bugzilla:
1548289: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

The MITRE CVE dictionary describes this issue as:

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Find out more about CVE-2018-1304 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 6.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Impact Low
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jbossweb) RHSA-2018:1449 2018-05-14
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server (jboss-ec2-eap) RHSA-2018:1451 2018-05-14
Red Hat JBoss Web Server 3.1 for RHEL 6 RHSA-2018:0466 2018-03-07
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server (jbossweb) RHSA-2018:1450 2018-05-14
Red Hat JBoss Web Server 3.1 RHSA-2018:0465 2018-03-07
Red Hat OpenShift Application Runtimes 1.0 RHSA-2018:1320 2018-05-03
Red Hat JBoss Enterprise Application Platform 6.4 RHSA-2018:1447 2018-05-14
Red Hat JBoss Web Server 3.1 for RHEL 7 RHSA-2018:0466 2018-03-07
Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server (jbossweb) RHSA-2018:1448 2018-05-14

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux rh-java-common-tomcat Not affected
Red Hat JBoss Portal Platform 6 jbossweb Will not fix
Red Hat JBoss Operations Network 3 jbossweb Not affected
Red Hat JBoss Fuse 6 karaf Not affected
Red Hat JBoss Fuse 6 jbossweb Not affected
Red Hat JBoss EWS 2 tomcat7 Will not fix
Red Hat JBoss EWS 2 tomcat6 Not affected
Red Hat JBoss Data Virtualization 6 jbossweb Not affected
Red Hat JBoss Data Grid 6 jbossweb Will not fix
Red Hat Enterprise Linux 7 tomcat Affected
Red Hat Enterprise Linux 6 tomcat6 Not affected
Red Hat Enterprise Linux 5 tomcat5 Not affected

External References

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.