The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Fix
Patch, vendor advisory and mitigation references on NVD 10
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181018-0002/ Patch, Third Party Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181018-0002/ Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · apache, canonical, debianNVD modified 2026-10-15 18:17
Affected (CPE criteria) 14
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*
References 78
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/104203 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040998 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041888 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2469 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2470 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0450 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0451 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://seclists.org/bugtraq/2019/Dec/43
- https://security.netapp.com/advisory/ntap-20181018-0002/ Patch, Third Party Advisory
- https://usn.ubuntu.com/3665-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4596
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/104203 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040998 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041888 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2469 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2470 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0450 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0451 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E