The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Fix
Public exploits 2
- knqyf263/CVE-2018-1304 PoC on GitHub
- thariyarox/tomcat_CVE-2018-1304_testing PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 8
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/ Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/ Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.9 · apache, redhat, debianNVD modified 2026-10-15 18:17
Affected (CPE criteria) 46
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:6:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:a:oracle:fusion_middleware:12.2.1.3.0:*:*:*:*:*:*:*- and 6 more
References 80
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/103170 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040427 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0465 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0466 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1320 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/ Patch, Third Party Advisory
- https://usn.ubuntu.com/3665-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4281 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/103170 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040427 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0465 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0466 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1320 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2939 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E