Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- http://tomcat.apache.org/security-6.html Vendor Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-6.html Vendor Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · apache, debian, oracleNVD modified 2026-10-09 20:17
Affected (CPE criteria) 193
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc9:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:1.1.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*- and 153 more
References 62
- http://advisories.mageia.org/MGASA-2014-0148.html Third Party Advisory
- http://marc.info/?l=bugtraq&m=144498216801440&w=2 Mailing List
- http://secunia.com/advisories/59036 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59722 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59724 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59873 Permissions Required, Third Party Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1549528 Issue Tracking
- http://svn.apache.org/viewvc?view=revision&revision=1549529 Issue Tracking
- http://svn.apache.org/viewvc?view=revision&revision=1558828 Issue Tracking
- http://tomcat.apache.org/security-6.html Vendor Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21667883 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21675886 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21677147 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231 Third Party Advisory
- http://www.debian.org/security/2016/dsa-3530 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www.securityfocus.com/bid/65768 Third Party Advisory, VDB Entry
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1069911 Issue Tracking
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
- http://advisories.mageia.org/MGASA-2014-0148.html Third Party Advisory
- http://marc.info/?l=bugtraq&m=144498216801440&w=2 Mailing List
- http://secunia.com/advisories/59036 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59722 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59724 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/59873 Permissions Required, Third Party Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1549528 Issue Tracking
- http://svn.apache.org/viewvc?view=revision&revision=1549529 Issue Tracking
- http://svn.apache.org/viewvc?view=revision&revision=1558828 Issue Tracking
- http://tomcat.apache.org/security-6.html Vendor Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21667883 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21675886 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21677147 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231 Third Party Advisory
- http://www.debian.org/security/2016/dsa-3530 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://www.securityfocus.com/bid/65768 Third Party Advisory, VDB Entry
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1069911 Issue Tracking
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E