Read the docs
TI-2013-03752 Aliases CVE-2013-4286GHSA-j448-j653-r3vj

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP…

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 29 fixed, 4 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.16206 96th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 6.0.39, 7.0.47, 8.0.0-RC3Red Hat: 15 advisoriesRed Hat: 29 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)before 6.0.396.0.39Patch availableGHSA-j448-j653-r3vj
—org.apache.tomcat:tomcat (Maven)7.0.0 to before 7.0.477.0.47Patch availableGHSA-j448-j653-r3vj
—org.apache.tomcat:tomcat (Maven)8.0.0-RC1 to before 8.0.0-RC38.0.0-RC3Patch availableGHSA-j448-j653-r3vj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected before 6.0.39 Fixed in 6.0.39 Patch available GHSA-j448-j653-r3vj
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.47 Fixed in 7.0.47 Patch available GHSA-j448-j653-r3vj
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0-RC1 to before 8.0.0-RC3 Fixed in 8.0.0-RC3 Patch available GHSA-j448-j653-r3vj

CPE configurations NVD · 183

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*7.0.0 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*7.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*7.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*7.0.4 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*7.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*7.0.11VulnerableApache
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
Show 173 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*7.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*7.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*7.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*7.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*7.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*7.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*7.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*7.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*7.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*7.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*7.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*7.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*7.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*7.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*7.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*7.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*7.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*7.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*7.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*7.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*7.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*7.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*7.0.34VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*7.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*7.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*7.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*7.0.38VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*7.0.39VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*7.0.40VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*7.0.41VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*7.0.42VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*7.0.43VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*7.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*7.0.45VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*7.0.46VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2VulnerableApache
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*up to 6.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*3.0VulnerableApache
cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*3.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*3.2.2 beta2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableApache
cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*3.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:*3.3.1aVulnerableApache
cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableApache
cpe:2.3:a:apache:tomcat:4:*:*:*:*:*:*:*4VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*4.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*4.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*4.1.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*4.1.3 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*4.1.9 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*4.1.10VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*4.1.12VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*4.1.15VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*4.1.24VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*4.1.28VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*4.1.29VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*4.1.31VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*4.1.36VulnerableApache
cpe:2.3:a:apache:tomcat:5:*:*:*:*:*:*:*5VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:*5.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:*5.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:*5.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:*5.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:*5.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:*5.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:*5.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:*5.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:*5.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:*5.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:*5.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*5.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:*5.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:*5.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:*5.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:*5.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:*5.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:*5.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:*5.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*5.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:*5.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:*5.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*5.5.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*5.5.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*5.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*5.5.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*5.5.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*5.5.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*5.5.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*5.5.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*5.5.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*5.5.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*5.5.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*5.5.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*5.5.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*5.5.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*5.5.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*5.5.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*5.5.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*5.5.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*5.5.20VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*5.5.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*5.5.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*5.5.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*5.5.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*5.5.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*5.5.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*5.5.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*5.5.28VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*5.5.29VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*5.5.30VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:*5.5.31VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*5.5.32VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*5.5.33VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:*5.5.34VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:*5.5.35VulnerableApache
cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*6VulnerableApache
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*6.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*6.0.0 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*6.0.1 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*6.0.2 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*6.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*6.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*6.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*6.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*6.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*6.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*6.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*6.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*6.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*6.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*6.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*6.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*6.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*6.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*6.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*6.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*6.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*6.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*6.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*6.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*6.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*6.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*6.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*6.0.36VulnerableApache
  • cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* Versions 7.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* Versions 7.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* Versions 7.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* Versions 7.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* Versions 7.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* Versions 7.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* Versions 7.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* Versions 7.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* Versions 7.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* Versions 7.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* Versions 7.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* Versions 7.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* Versions 7.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* Versions 7.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* Versions 7.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions up to 6.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:* Versions 3.2.2 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:* Versions 3.3.1a Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:* Versions 4.1.3 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:* Versions 4.1.9 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:* Versions 4.1.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:* Versions 4.1.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* Versions 4.1.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* Versions 4.1.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:* Versions 4.1.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* Versions 4.1.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* Versions 4.1.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* Versions 4.1.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:* Versions 5.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:* Versions 5.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:* Versions 5.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:* Versions 5.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:* Versions 5.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:* Versions 5.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:* Versions 5.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:* Versions 5.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:* Versions 5.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:* Versions 5.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:* Versions 5.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:* Versions 5.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:* Versions 5.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:* Versions 5.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:* Versions 5.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:* Versions 5.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:* Versions 5.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:* Versions 5.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:* Versions 5.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:* Versions 5.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:* Versions 5.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:* Versions 5.5.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:* Versions 5.5.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:* Versions 5.5.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:* Versions 5.5.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:* Versions 5.5.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:* Versions 5.5.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:* Versions 5.5.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* Versions 6.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* Versions 6.0.1 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* Versions 6.0.2 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* Versions 6.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* Versions 6.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* Versions 6.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* Versions 6.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* Versions 6.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* Versions 6.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* Versions 6.0.36 Vulnerable ·Apache

Remediation

  • Fix · GHSA-j448-j653-r3vj org.apache.tomcat:tomcat (Maven) Fixed in 6.0.39 Advisory →
  • Fix · GHSA-j448-j653-r3vj org.apache.tomcat:tomcat (Maven) Fixed in 7.0.47 Advisory →
  • Fix · GHSA-j448-j653-r3vj org.apache.tomcat:tomcat (Maven) Fixed in 8.0.0-RC3 Advisory →

Red Hat 15 advisories

  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2014:0686 Released 2014-06-10 · Red Hat rating Important
    tomcat security update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.42-5.el7_0, tomcat-servlet-3.0-api-7.0.42-5.el7_0
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.42-5.el7_0, tomcat-admin-webapps-7.0.42-5.el7_0, tomcat-docs-webapp-7.0.42-5.el7_0 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.42-5.el7_0, tomcat-servlet-3.0-api-7.0.42-5.el7_0
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.42-5.el7_0, tomcat-admin-webapps-7.0.42-5.el7_0, tomcat-docs-webapp-7.0.42-5.el7_0 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.42-5.el7_0, tomcat-admin-webapps-7.0.42-5.el7_0, tomcat-el-2.2-api-7.0.42-5.el7_0 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.42-5.el7_0, tomcat-admin-webapps-7.0.42-5.el7_0, tomcat-docs-webapp-7.0.42-5.el7_0 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.42-5.el7_0, tomcat-admin-webapps-7.0.42-5.el7_0, tomcat-el-2.2-api-7.0.42-5.el7_0 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.42-5.el7_0, tomcat-javadoc-7.0.42-5.el7_0, tomcat-jsvc-7.0.42-5.el7_0
  • RHSA-2014:0526 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat7-7.0.40-13_patch_02.ep6.el5, tomcat7-admin-webapps-7.0.40-13_patch_02.ep6.el5, tomcat7-docs-webapp-7.0.40-13_patch_02.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7-7.0.40-9_patch_02.ep6.el6, tomcat7-admin-webapps-7.0.40-9_patch_02.ep6.el6, tomcat7-docs-webapp-7.0.40-9_patch_02.ep6.el6 +7
Show 12 more Red Hat advisories
  • RHSA-2014:0525 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat6-6.0.37-19_patch_04.ep6.el5, tomcat6-admin-webapps-6.0.37-19_patch_04.ep6.el5, tomcat6-docs-webapp-6.0.37-19_patch_04.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6-6.0.37-27_patch_04.ep6.el6, tomcat6-admin-webapps-6.0.37-27_patch_04.ep6.el6, tomcat6-docs-webapp-6.0.37-27_patch_04.ep6.el6 +7
  • RHSA-2014:0527 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0528 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0511 Released 2014-05-15 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.2.1 security update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2014:0458 Released 2014-04-30 · Red Hat rating Moderate
    Red Hat JBoss Data Virtualization 6.0.0 security update
    • Red Hat JBoss Data Virtualization 6.0
  • RHSA-2014:0459 Released 2014-04-30 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2014:0429 Released 2014-04-23 · Red Hat rating Moderate
    tomcat6 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2
  • RHSA-2014:0374 Released 2014-04-03 · Red Hat rating Important
    Red Hat JBoss Data Grid 6.2.1 update
    • Red Hat JBoss Data Grid 6.2
  • RHSA-2014:0373 Released 2014-04-03 · Red Hat rating Moderate
    Apache Commons Fileupload and JBoss Web security update
    • Red Hat JBoss BPMS 6.0
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:0344 Released 2014-03-31 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.2 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server ironjacamar-common-api-eap6-1.0.23-5.Final_redhat_5.1.ep6.el6, ironjacamar-common-impl-eap6-1.0.23-5.Final_redhat_5.1.ep6.el6, ironjacamar-common-spi-eap6-1.0.23-5.Final_redhat_5.1.ep6.el6 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server apache-cxf-2.7.10-1.redhat_1.1.ep6.el6, glassfish-jsf-eap6-2.1.27-6.redhat_8.1.ep6.el6, jboss-ejb-client-1.0.25-1.Final_redhat_1.1.ep6.el6 +13
  • RHSA-2014:0343 Released 2014-03-31 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.2 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server ironjacamar-common-api-eap6-1.0.23-5.Final_redhat_5.1.ep6.el5, ironjacamar-common-impl-eap6-1.0.23-5.Final_redhat_5.1.ep6.el5, ironjacamar-common-spi-eap6-1.0.23-5.Final_redhat_5.1.ep6.el5 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server apache-cxf-2.7.10-1.redhat_1.1.ep6.el5, glassfish-jsf-eap6-2.1.27-6.redhat_8.1.ep6.el5, jboss-ejb-client-1.0.25-1.Final_redhat_1.1.ep6.el5 +13
  • RHSA-2014:0345 Released 2014-03-31 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.2 update
    • Red Hat JBoss Enterprise Application Platform 6.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:0686
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:0686
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0373
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0373
Red Hat JBoss Data Grid 6.2Fixed RHSA-2014:0374
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2014:0458
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2014:0343
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2014:0344
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0345
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0343
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0344
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 ServerFixed RHSA-2014:0525, RHSA-2014:0526
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 ServerFixed RHSA-2014:0525, RHSA-2014:0526
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:0459
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:0511
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Red Hat JBoss Web Server 2.0Fixed RHSA-2014:0528

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4286
  2. 2026-10-03 Alias added: GHSA-j448-j653-r3vj
  3. 2026-10-10 CISA SSVC decision points changed

References

Advisory 13

Other 50

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences