org.apache.tomcat CVEs

Look up CVE IDs Status Exploitation Severity

Reset

Overview 112 matches · 16 protected · 7 exploited · 5 CISA KEV · 20 public PoC · 17 EPSS ≥ 0.5

112matches 16protected14.3% 7exploited6.2% 5CISA KEV4.5% 20public PoC17.9% 17EPSS ≥ 0.515.2%

Protected by Waratek 17 15.2% Rule in development 0 0.0% Mitigation candidate 11 9.8% No exploit published 84 75.0%

Critical 19 17.0% High 59 52.7% Medium 32 28.6% Low 2 1.8% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 16 14.3% partly blocked 1 0.9% not blocked 95 84.8% not established 0 0.0% unrecorded 0 0.0%

Exploited 7 6.2% Working exploit published 8 7.1% Proof of concept only 6 5.4% Forecast only 6 5.4% No public exploit 85 75.9%

split by StatusSeverityProtectionExploit maturity peak 31 / year

20166 Protected by Waratek2 No exploit published4 High2 Medium4 blocked by ARMR today2 not blocked4 Forecast only1 No public exploit5 201717 Protected by Waratek4 No exploit published13 Critical4 High11 Medium2 blocked by ARMR today3 partly blocked1 not blocked13 Exploited2 Working exploit published1 Forecast only1 No public exploit13 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20192 Mitigation candidate1 No exploit published1 High1 Medium1 not blocked2 Working exploit published1 Forecast only1 20208 Protected by Waratek1 Mitigation candidate2 No exploit published5 High6 Medium2 blocked by ARMR today1 not blocked7 Working exploit published2 Proof of concept only1 Forecast only2 No public exploit3 20216 Protected by Waratek2 No exploit published4 High4 Medium2 blocked by ARMR today2 not blocked4 Forecast only1 No public exploit5 20226 Protected by Waratek2 Mitigation candidate1 No exploit published3 High4 Medium1 Low1 blocked by ARMR today2 not blocked4 Exploited1 Working exploit published1 No public exploit4 202311 Mitigation candidate3 No exploit published8 High6 Medium5 not blocked11 Exploited1 Working exploit published1 Proof of concept only1 No public exploit8 202411 Mitigation candidate4 No exploit published7 Critical3 High3 Medium5 not blocked11 Exploited1 Proof of concept only3 No public exploit7 202513 Protected by Waratek4 No exploit published9 Critical1 High10 Medium2 blocked by ARMR today4 not blocked9 Exploited1 Working exploit published1 Proof of concept only1 No public exploit10 202631 Protected by Waratek2 No exploit published29 Critical11 High12 Medium7 Low1 blocked by ARMR today2 not blocked29 Exploited1 Working exploit published1 No public exploit29

20162017201820192020202120222023202420252026

112 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2017-5650	High	2017-04-17	No exploit published	No public exploit	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
CVE-2017-5648	Critical	2017-04-17	No exploit published	No public exploit	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
CVE-2017-5647	High	2017-04-17	No exploit published	No public exploit	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
CVE-2016-8735	Critical	2017-04-06	Protected by Waratek	Exploited	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVE-2016-6816	High	2017-03-20	Protected by Waratek	Working exploit published	The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
CVE-2016-8747	High	2017-03-14	No exploit published	No public exploit	An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.
CVE-2016-5388	High	2016-07-19	No exploit published	Forecast only	Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
CVE-2016-0763	Medium	2016-02-25	No exploit published	No public exploit	The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
CVE-2016-0706	Medium	2016-02-25	No exploit published	No public exploit	Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
CVE-2015-5351	High	2016-02-25	No exploit published	No public exploit	The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
CVE-2015-5345	Medium	2016-02-25	Protected by Waratek	No public exploit	The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVE-2015-5174	Medium	2016-02-25	Protected by Waratek	No public exploit	Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2017-5650

High

2017-04-17

No exploit published

No public exploit

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

CVE-2017-5648

Critical

2017-04-17

No exploit published

No public exploit

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

CVE-2017-5647

High

2017-04-17

No exploit published

No public exploit

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

CVE-2016-8735

Critical

2017-04-06

Protected by Waratek

Exploited

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

CVE-2016-6816

High

2017-03-20

Protected by Waratek

Working exploit published

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

CVE-2016-8747

High

2017-03-14

No exploit published

No public exploit

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

CVE-2016-5388

High

2016-07-19

No exploit published

Forecast only

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVE-2016-0763

Medium

2016-02-25

No exploit published

No public exploit

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

CVE-2016-0706

Medium

2016-02-25

No exploit published

No public exploit

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

CVE-2015-5351

High

2016-02-25

No exploit published

No public exploit

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

CVE-2015-5345

Medium

2016-02-25

Protected by Waratek

No public exploit

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

CVE-2015-5174

Medium

2016-02-25

Protected by Waratek

No public exploit

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.