Detections
Analytics
Apache Tomcat 8.5.0 < 8.5.16 multiple vulnerabilities
high Nessus Plugin ID 102589
Language:
Synopsis
The remote Apache Tomcat server is affected by multiple vulnerabilitiesDescription
The version of Tomcat installed on the remote host is prior to 8.5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.16_security-8 advisory.- The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL. (CVE-2017-7675)
- The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Apache Tomcat version 8.5.16 or later.See Also
http://www.nessus.org/u?16acd6f7
https://bz.apache.org/bugzilla/show_bug.cgi?id=61101
https://bz.apache.org/bugzilla/show_bug.cgi?id=61120
Plugin Details
Severity: High
ID: 102589
File Name: tomcat_8_5_16.nasl
Version: 1.12
Type: combined
Agent: windows, macosx, unix
Family: Web Servers
Published: 8/18/2017
Updated: 5/23/2024
Configuration: Enable thorough checks
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2017-7675
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:tomcat:8
Required KB Items: installed_sw/Apache Tomcat
Exploit Ease: No known exploits are available
Patch Publication Date: 8/10/2017
Vulnerability Publication Date: 5/16/2017
Reference Information
CVE: CVE-2017-7674, CVE-2017-7675