NetSight
IP …
medium5.9

CVE-2018-1304

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, …

Impact

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.0 through 7.0.84
from 8.0.0 through 8.0.49
from 8.5.0 through 8.5.27
from 9.0.0 through 9.0.4
Versions 8.0.0, 9.0.0
RedhatJboss Enterprise Application Platform
Versions 6, 6.4
RedhatJboss Enterprise Web Server
Version 3.0.0
DebianDebian Linux
Versions 7.0, 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10, 18.04
OracleFusion Middleware
Version 12.2.1.3.0
OracleHospitality Guest Access
Versions 4.2.0, 4.2.1
OracleMicros Relate Crm Software
Version 11.4
OracleSecure Global Desktop
Versions 5.3, 5.4
RedhatJboss Middleware
Version 1

References