TI-2020-01862 CVE-2020-1938 · GHSA-c9hw-wf7x-jp9j
Improper privilege management in Apache Tomcat
Priority CRITICAL 100KEV
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.
RHSA-2020:0861
Red Hat JBoss Web Server 3.1 Service Pack 8 security update
Released 2020-03-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-21.redhat_21.ep7.el6, tomcat7-7.0.70-38.ep7.el6, tomcat7-admin-webapps-7.0.70-38.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-21.redhat_21.ep7.el7, tomcat7-7.0.70-38.ep7.el7, tomcat7-admin-webapps-7.0.70-38.ep7.el7 +22
Fixes 4 records
TI-2019-00194 CVE-2019-0221 · GHSA-jjpq-gp5q-8q6w
Cross-site scripting in Apache Tomcat
Priority MEDIUM 61
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS.
TI-2019-13106 CVE-2019-17563 · GHSA-9xcj-c8cr-8c3c
Session fixation in Apache Tomcat
Priority MEDIUM 48
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack.
TI-2019-09263 CVE-2019-12418 · GHSA-hh3j-x4mc-g48r
Insufficiently protected credentials in Apache Tomcat
Priority LOW 35
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manip…