Read the docs
TI-2013-04033 Aliases CVE-2013-4590GHSA-87w9-x2c3-hrjj

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows…

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 9 fixed, 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09487 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 6.0.39, 7.0.50, 8.0.0-RC10Red Hat: 4 advisoriesRed Hat: 9 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)before 6.0.396.0.39Patch availableGHSA-87w9-x2c3-hrjj
—org.apache.tomcat:tomcat (Maven)7.0.0 to before 7.0.507.0.50Patch availableGHSA-87w9-x2c3-hrjj
—org.apache.tomcat:tomcat (Maven)8.0.0-RC1 to before 8.0.0-RC108.0.0-RC10Patch availableGHSA-87w9-x2c3-hrjj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected before 6.0.39 Fixed in 6.0.39 Patch available GHSA-87w9-x2c3-hrjj
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.50 Fixed in 7.0.50 Patch available GHSA-87w9-x2c3-hrjj
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0-RC1 to before 8.0.0-RC10 Fixed in 8.0.0-RC10 Patch available GHSA-87w9-x2c3-hrjj

CPE configurations NVD · 193

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*8.0.0 rc3VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc4:*:*:*:*:*:*8.0.0 rc4VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*8.0.0 rc5VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc6:*:*:*:*:*:*8.0.0 rc6VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc7:*:*:*:*:*:*8.0.0 rc7VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc8:*:*:*:*:*:*8.0.0 rc8VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc9:*:*:*:*:*:*8.0.0 rc9VulnerableApache
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:* Versions 8.0.0 rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc4:*:*:*:*:*:* Versions 8.0.0 rc4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc6:*:*:*:*:*:* Versions 8.0.0 rc6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc7:*:*:*:*:*:* Versions 8.0.0 rc7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc8:*:*:*:*:*:* Versions 8.0.0 rc8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc9:*:*:*:*:*:* Versions 8.0.0 rc9 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
Show 183 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*up to 6.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*3.0VulnerableApache
cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*3.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*3.2.2 beta2VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableApache
cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*3.3VulnerableApache
cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableApache
cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:*3.3.1aVulnerableApache
cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableApache
cpe:2.3:a:apache:tomcat:4:*:*:*:*:*:*:*4VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*4.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*4.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*4.1.3VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*4.1.3 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*4.1.9 betaVulnerableApache
cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*4.1.10VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*4.1.12VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*4.1.15VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*4.1.24VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*4.1.28VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*4.1.29VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*4.1.31VulnerableApache
cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*4.1.36VulnerableApache
cpe:2.3:a:apache:tomcat:5:*:*:*:*:*:*:*5VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:*5.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:*5.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:*5.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:*5.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:*5.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:*5.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:*5.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:*5.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:*5.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:*5.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:*5.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:*5.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:*5.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:*5.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:*5.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:*5.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*5.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:*5.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:*5.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:*5.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:*5.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:*5.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:*5.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:*5.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*5.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:*5.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:*5.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*5.5.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*5.5.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*5.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*5.5.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*5.5.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*5.5.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*5.5.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*5.5.9VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*5.5.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*5.5.11VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*5.5.12VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*5.5.13VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*5.5.14VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*5.5.15VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*5.5.16VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*5.5.17VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*5.5.18VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*5.5.19VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*5.5.20VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*5.5.21VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*5.5.22VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*5.5.23VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*5.5.24VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*5.5.25VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:*5.5.26VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:*5.5.27VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:*5.5.28VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:*5.5.29VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:*5.5.30VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:*5.5.31VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:*5.5.32VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:*5.5.33VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:*5.5.34VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:*5.5.35VulnerableApache
cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*6VulnerableApache
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*6.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*6.0.0 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*6.0.1 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*6.0.2 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*6.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*6.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*6.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*6.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*6.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*6.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*6.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*6.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*6.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*6.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*6.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*6.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*6.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*6.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*6.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*6.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*6.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*6.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*6.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*6.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*6.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*6.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*6.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*6.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*7.0.0 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*7.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*7.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*7.0.4 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*7.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*7.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*7.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*7.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*7.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*7.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*7.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*7.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*7.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*7.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*7.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*7.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*7.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*7.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*7.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*7.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*7.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*7.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*7.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*7.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*7.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*7.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*7.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*7.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*7.0.34VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*7.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*7.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*7.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*7.0.38VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*7.0.39VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*7.0.40VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*7.0.41VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*7.0.42VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*7.0.43VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*7.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*7.0.45VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*7.0.46VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*7.0.50VulnerableApache
cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*11.2VulnerableOracle
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions up to 6.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:* Versions 3.2.2 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.1a:*:*:*:*:*:*:* Versions 3.3.1a Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:* Versions 4.1.3 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:* Versions 4.1.9 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:* Versions 4.1.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:* Versions 4.1.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* Versions 4.1.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* Versions 4.1.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:* Versions 4.1.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* Versions 4.1.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* Versions 4.1.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* Versions 4.1.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.9:*:*:*:*:*:*:* Versions 5.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.10:*:*:*:*:*:*:* Versions 5.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.11:*:*:*:*:*:*:* Versions 5.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.12:*:*:*:*:*:*:* Versions 5.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.13:*:*:*:*:*:*:* Versions 5.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.14:*:*:*:*:*:*:* Versions 5.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.15:*:*:*:*:*:*:* Versions 5.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.16:*:*:*:*:*:*:* Versions 5.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.17:*:*:*:*:*:*:* Versions 5.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.18:*:*:*:*:*:*:* Versions 5.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:* Versions 5.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.21:*:*:*:*:*:*:* Versions 5.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.22:*:*:*:*:*:*:* Versions 5.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.23:*:*:*:*:*:*:* Versions 5.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.24:*:*:*:*:*:*:* Versions 5.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.25:*:*:*:*:*:*:* Versions 5.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.26:*:*:*:*:*:*:* Versions 5.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.27:*:*:*:*:*:*:* Versions 5.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:* Versions 5.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.29:*:*:*:*:*:*:* Versions 5.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.0.30:*:*:*:*:*:*:* Versions 5.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:* Versions 5.5.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:* Versions 5.5.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.31:*:*:*:*:*:*:* Versions 5.5.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:* Versions 5.5.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.33:*:*:*:*:*:*:* Versions 5.5.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:* Versions 5.5.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.35:*:*:*:*:*:*:* Versions 5.5.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* Versions 6.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* Versions 6.0.1 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* Versions 6.0.2 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* Versions 6.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* Versions 6.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* Versions 6.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* Versions 6.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* Versions 6.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* Versions 6.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* Versions 6.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* Versions 7.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* Versions 7.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* Versions 7.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* Versions 7.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* Versions 7.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* Versions 7.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* Versions 7.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* Versions 7.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* Versions 7.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* Versions 7.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* Versions 7.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* Versions 7.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* Versions 7.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* Versions 7.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* Versions 7.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* Versions 7.0.50 Vulnerable ·Apache
  • cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-87w9-x2c3-hrjj org.apache.tomcat:tomcat (Maven) Fixed in 6.0.39 Advisory →
  • Fix · GHSA-87w9-x2c3-hrjj org.apache.tomcat:tomcat (Maven) Fixed in 7.0.50 Advisory →
  • Fix · GHSA-87w9-x2c3-hrjj org.apache.tomcat:tomcat (Maven) Fixed in 8.0.0-RC10 Advisory →

Red Hat 4 advisories

  • RHSA-2014:1086 Released 2014-08-21 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.0 update
    • Red Hat JBoss Web Server 2.1
  • RHSA-2014:1087 Released 2014-08-21 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.0 update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el6, apache-commons-collections-eap6-3.2.1-15.redhat_3.1.ep6.el6, apache-commons-collections-tomcat-eap6-3.2.1-15.redhat_3.1.ep6.el6 +47
  • RHSA-2014:1088 Released 2014-08-21 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.0 update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el5, apache-commons-collections-eap6-3.2.1-15.redhat_3.1.ep6.el5, apache-commons-collections-tomcat-eap6-3.2.1-15.redhat_3.1.ep6.el5 +47
Show 1 more Red Hat advisories
  • RHSA-2014:1038 Released 2014-08-11 · Red Hat rating Low
    tomcat6 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-el-2.1-api-6.0.24-78.el6_5, tomcat6-jsp-2.1-api-6.0.24-78.el6_5 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +2
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-el-2.1-api-6.0.24-78.el6_5, tomcat6-jsp-2.1-api-6.0.24-78.el6_5 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +2

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1038
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1038
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1038
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1038
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1038
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1038
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 ServerFixed RHSA-2014:1088
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 ServerFixed RHSA-2014:1087
Red Hat JBoss Web Server 2.1Fixed RHSA-2014:1086
Not affected: 10 products
  • Red Hat BPM Suite 6
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat JBoss Portal 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4590
  2. 2026-10-03 Alias added: GHSA-87w9-x2c3-hrjj
  3. 2026-10-10 CISA SSVC decision points changed

References

Advisory 14

Other 23

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences