Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly…
Priority LOW 36CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Partial Red Hat: 27 fixed, 4 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.
Summary
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07616 94th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 6.0.40, 7.0.54, 8.0.6org.apache.tomcat:tomcat-catalina (Maven): 6.0.40, 7.0.54, 8.0.6+1 more productRed Hat: 14 advisoriesRed Hat: 27 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | before 6.0.40 | 6.0.40 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat (Maven) | 7.0.0 to before 7.0.54 | 7.0.54 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat (Maven) | 8.0.0 to before 8.0.6 | 8.0.6 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-catalina (Maven) | before 6.0.40 | 6.0.40 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 7.0.0 to before 7.0.54 | 7.0.54 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.0.0 to before 8.0.6 | 8.0.6 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-jasper (Maven) | before 6.0.40 | 6.0.40 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 7.0.0 to before 7.0.54 | 7.0.54 | Patch available | GHSA-prc3-7f44-w48j |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 8.0.0 to before 8.0.6 | 8.0.6 | Patch available | GHSA-prc3-7f44-w48j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected before 6.0.40 Fixed in 6.0.40 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.54 Fixed in 7.0.54 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0 to before 8.0.6 Fixed in 8.0.6 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected before 6.0.40 Fixed in 6.0.40 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 7.0.0 to before 7.0.54 Fixed in 7.0.54 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.0.0 to before 8.0.6 Fixed in 8.0.6 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected before 6.0.40 Fixed in 6.0.40 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 7.0.0 to before 7.0.54 Fixed in 7.0.54 Patch available GHSA-prc3-7f44-w48j
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 8.0.0 to before 8.0.6 Fixed in 8.0.6 Patch available GHSA-prc3-7f44-w48j
CPE configurations NVD · 109
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* | 8.0.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* | 8.0.0 rc10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* | 8.0.0 rc2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* | 8.0.0 rc5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* | 8.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:* | 8.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:* | 8.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | up to 6.0.39 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* | 6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* Versions 8.0.0 rc10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions up to 6.0.39 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
Show 99 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* | 6.0.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* | 6.0.1 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* | 6.0.2 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* | 6.0.2 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* | 6.0.4 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* | 6.0.6 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* | 6.0.7 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* | 6.0.7 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* | 6.0.8 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* | 6.0.9 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* | 6.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* | 6.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* | 6.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* | 6.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* | 6.0.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* | 6.0.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* | 6.0.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* | 6.0.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* | 6.0.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* | 6.0.30 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* | 6.0.31 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* | 6.0.32 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* | 6.0.33 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* | 6.0.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* | 6.0.36 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:* | 6.0.37 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* | 7.0.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* | 7.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* | 7.0.2 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* | 7.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* | 7.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* | 7.0.4 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* | 7.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* | 7.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* | 7.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* | 7.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* | 7.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* | 7.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* | 7.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* | 7.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* | 7.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* | 7.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* | 7.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* | 7.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* | 7.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* | 7.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* | 7.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* | 7.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* | 7.0.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* | 7.0.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* | 7.0.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* | 7.0.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* | 7.0.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* | 7.0.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* | 7.0.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* | 7.0.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* | 7.0.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* | 7.0.30 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* | 7.0.31 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* | 7.0.32 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* | 7.0.33 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* | 7.0.34 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* | 7.0.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* | 7.0.36 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* | 7.0.37 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* | 7.0.38 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* | 7.0.39 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* | 7.0.40 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* | 7.0.41 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* | 7.0.42 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* | 7.0.43 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* | 7.0.44 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* | 7.0.45 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* | 7.0.46 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* | 7.0.47 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* | 7.0.48 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* | 7.0.49 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* | 7.0.50 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:* | 7.0.52 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:* | 7.0.53 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* Versions 6.0.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* Versions 6.0.1 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* Versions 6.0.2 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* Versions 6.0.2 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* Versions 6.0.4 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* Versions 6.0.6 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* Versions 6.0.7 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* Versions 6.0.7 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* Versions 6.0.8 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* Versions 6.0.9 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* Versions 6.0.30 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* Versions 6.0.31 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* Versions 6.0.32 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* Versions 6.0.33 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* Versions 6.0.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* Versions 6.0.36 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:* Versions 6.0.37 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* Versions 7.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* Versions 7.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* Versions 7.0.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* Versions 7.0.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* Versions 7.0.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* Versions 7.0.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* Versions 7.0.30 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* Versions 7.0.31 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* Versions 7.0.32 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* Versions 7.0.33 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* Versions 7.0.34 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* Versions 7.0.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* Versions 7.0.36 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* Versions 7.0.37 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* Versions 7.0.38 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* Versions 7.0.39 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* Versions 7.0.40 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* Versions 7.0.47 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* Versions 7.0.48 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* Versions 7.0.49 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* Versions 7.0.50 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:* Versions 7.0.52 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:* Versions 7.0.53 Vulnerable ·Apache
Remediation
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat (Maven) Fixed in 6.0.40 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat (Maven) Fixed in 7.0.54 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat (Maven) Fixed in 8.0.6 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-catalina (Maven) Fixed in 6.0.40 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-catalina (Maven) Fixed in 7.0.54 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.0.6 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-jasper (Maven) Fixed in 6.0.40 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-jasper (Maven) Fixed in 7.0.54 Advisory →
- Fix · GHSA-prc3-7f44-w48j org.apache.tomcat:tomcat-jasper (Maven) Fixed in 8.0.6 Advisory →
Red Hat 14 advisories
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
- RHSA-2015:0765 Released 2015-03-31 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.0.0 security update
- Red Hat JBoss Data Virtualization 6.0
- RHSA-2015:0720 Released 2015-03-24 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.0.0 security update
- Red Hat JBoss Fuse Service Works 6.0
Show 11 more Red Hat advisories
- RHSA-2015:0675 Released 2015-03-11 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.1.0 update
- Red Hat JBoss Data Virtualization 6.1
- RHSA-2015:0234 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.3 security update
- Red Hat JBoss BPMS 6.0
- RHSA-2015:0235 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.3 security update
- Red Hat JBoss BRMS 6.0
- RHSA-2014:1086 Released 2014-08-21 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.0 update
- Red Hat JBoss Web Server 2.1
- RHSA-2014:1087 Released 2014-08-21 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.0 update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el6, apache-commons-collections-eap6-3.2.1-15.redhat_3.1.ep6.el6, apache-commons-collections-tomcat-eap6-3.2.1-15.redhat_3.1.ep6.el6 +47
- RHSA-2014:1088 Released 2014-08-21 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.0 update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el5, apache-commons-collections-eap6-3.2.1-15.redhat_3.1.ep6.el5, apache-commons-collections-tomcat-eap6-3.2.1-15.redhat_3.1.ep6.el5 +47
- RHSA-2014:1038 Released 2014-08-11 · Red Hat rating Lowtomcat6 security update
- Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +6
- Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-el-2.1-api-6.0.24-78.el6_5, tomcat6-jsp-2.1-api-6.0.24-78.el6_5 +2
- Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +2
- Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-el-2.1-api-6.0.24-78.el6_5, tomcat6-jsp-2.1-api-6.0.24-78.el6_5 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-78.el6_5, tomcat6-admin-webapps-6.0.24-78.el6_5, tomcat6-docs-webapp-6.0.24-78.el6_5 +2
- RHSA-2014:1034 Released 2014-08-07 · Red Hat rating Lowtomcat security update
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.42-8.el7_0, tomcat-servlet-3.0-api-7.0.42-8.el7_0
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.42-8.el7_0, tomcat-admin-webapps-7.0.42-8.el7_0, tomcat-docs-webapp-7.0.42-8.el7_0 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.42-8.el7_0, tomcat-servlet-3.0-api-7.0.42-8.el7_0
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.42-8.el7_0, tomcat-admin-webapps-7.0.42-8.el7_0, tomcat-docs-webapp-7.0.42-8.el7_0 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.42-8.el7_0, tomcat-admin-webapps-7.0.42-8.el7_0, tomcat-el-2.2-api-7.0.42-8.el7_0 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.42-8.el7_0, tomcat-admin-webapps-7.0.42-8.el7_0, tomcat-docs-webapp-7.0.42-8.el7_0 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.42-8.el7_0, tomcat-admin-webapps-7.0.42-8.el7_0, tomcat-el-2.2-api-7.0.42-8.el7_0 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.42-8.el7_0, tomcat-javadoc-7.0.42-8.el7_0, tomcat-jsvc-7.0.42-8.el7_0
- RHSA-2014:0895 Released 2014-07-16 · Red Hat rating ModerateRed Hat JBoss Data Grid 6.3.0 update
- Red Hat JBoss Data Grid 6.3
- RHSA-2014:0842 Released 2014-07-07 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.2.4 security update
- Red Hat JBoss Enterprise Application Platform 6.2
- RHSA-2014:0843 Released 2014-07-07 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.2.4 security update
- Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el5
- Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el6
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2014:1038 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2014:1034 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:0234 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:0235 |
| Red Hat JBoss Data Grid 6.3 | Fixed | RHSA-2014:0895 |
| Red Hat JBoss Data Virtualization 6.0 | Fixed | RHSA-2015:0765 |
| Red Hat JBoss Data Virtualization 6.1 | Fixed | RHSA-2015:0675 |
| Red Hat JBoss Enterprise Application Platform 6.2 | Fixed | RHSA-2014:0842 |
| Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server | Fixed | RHSA-2014:0843 |
| Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server | Fixed | RHSA-2014:0843 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server | Fixed | RHSA-2014:1088 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | Fixed | RHSA-2014:1087 |
| Red Hat JBoss Fuse Service Works 6.0 | Fixed | RHSA-2015:0720 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
| Red Hat JBoss Web Server 2.1 | Fixed | RHSA-2014:1086 |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-0119
- 2026-10-03 Alias added: GHSA-prc3-7f44-w48j
- 2026-10-15 CISA SSVC decision points changed
References
Advisory 15
Other 57
- http://svn.apache.org/viewvc?view=revision&revision=1590036
- http://advisories.mageia.org/MGASA-2014-0268.html
- http://svn.apache.org/viewvc?view=revision&revision=1589837
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21681528
- http://svn.apache.org/viewvc?view=revision&revision=1590028
- http://svn.apache.org/viewvc?view=revision&revision=1589992
- http://svn.apache.org/viewvc?view=revision&revision=1589983
- http://svn.apache.org/viewvc?view=revision&revision=1588199
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://svn.apache.org/viewvc?view=revision&revision=1589997
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231
- http://svn.apache.org/viewvc?view=revision&revision=1589980
- http://svn.apache.org/viewvc?view=revision&revision=1589640
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- 20140527 [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure
- http://svn.apache.org/viewvc?view=revision&revision=1589985
- http://svn.apache.org/viewvc?view=revision&revision=1593815
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- http://svn.apache.org/viewvc?view=revision&revision=1589990
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- http://svn.apache.org/viewvc?view=revision&revision=1588193
- http://svn.apache.org/viewvc?view=revision&revision=1593821
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat80/commit/d59fd4398c8ae6361e0b13c491f66b51e49a7441
- https://github.com/apache/tomcat80/commit/7d33457de5fc5a652a88fb9bbc9ba4cbbda58f04
- https://github.com/apache/tomcat80/commit/77e014cef5d5af619bcf77eaebf22c284d420802
- https://github.com/apache/tomcat80/commit/69a8a72283c3395ece8b899cf8562e126de97a27
- https://github.com/apache/tomcat80/commit/51e59532ad4c604f55575963dc7a7f0250cb420f
- https://github.com/apache/tomcat80/commit/4d90e355dc5ced4c53585c2b4700f71a52d8f447
- https://github.com/apache/tomcat80/commit/25251de791a6a7be13f2f3d3a66119a77025272d
- https://github.com/apache/tomcat/commit/f8b316acbbf9fabf87cc137e9777e912eda0d834
- https://github.com/apache/tomcat/commit/ebe5c16f18ce1559e8462a94b3876a98525980d2
- https://github.com/apache/tomcat/commit/080878ea519d8c74c53721a9ebf7be6fcf6f1f2f
- https://github.com/apache/tomcat/commit/50311bed8d87e452ff0e69838ba312c4fe899b2d
- https://github.com/apache/tomcat/commit/5517c5517e8a7ddb994504f0c5c05001a376b10c
- https://github.com/apache/tomcat/commit/5aae1323c31d643afa9f2db80713b8e97b5123af
- https://github.com/apache/tomcat/commit/6246d8307fb5f2b4ff0b0f4d6d1b0250dff01a81
- https://github.com/apache/tomcat/commit/769477b9bc8442db3f571385fa0c3e206242cbf1
- https://github.com/apache/tomcat/commit/934f884f330dad192d2c5dc950e28f4cd281461b
- https://github.com/apache/tomcat/commit/ad3b34a290a0255d2a4c356a3611ab41ed9d04f5
- https://github.com/apache/tomcat/commit/ce70ee6b8fe437a498a375215011056702b0c481
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2014-0119 · CVE Program
- CVE-2014-0119 · NVD
- FIRST EPSS
- GHSA-prc3-7f44-w48j · GitHub Advisory Database · CC BY 4.0
- CVE-2014-0119 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences