Read the docs
TI-2018-05791 Aliases CVE-2018-8014GHSA-r4x2-3cq5-hqvp

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8…

Priority MEDIUM 61CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 6 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.20942 97th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.9, 8.5.32, 8.0.53 +1Red Hat: 7 advisoriesRed Hat: 16 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat9.0.0.M1 to 9.0.8; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.41 to 7.0.88—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0.M1 to before 9.0.99.0.9Patch availableGHSA-r4x2-3cq5-hqvp
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.0 to before 8.5.328.5.32Patch availableGHSA-r4x2-3cq5-hqvp
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.0.0RC1 to before 8.0.538.0.53Patch availableGHSA-r4x2-3cq5-hqvp
—org.apache.tomcat.embed:tomcat-embed-core (Maven)7.0.41 to before 7.0.887.0.88Patch availableGHSA-r4x2-3cq5-hqvp
  • Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.8; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.41 to 7.0.88 Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.9 Fixed in 9.0.9 Patch available GHSA-r4x2-3cq5-hqvp
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.32 Fixed in 8.5.32 Patch available GHSA-r4x2-3cq5-hqvp
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0RC1 to before 8.0.53 Fixed in 8.0.53 Patch available GHSA-r4x2-3cq5-hqvp
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.41 to before 7.0.88 Fixed in 7.0.88 Patch available GHSA-r4x2-3cq5-hqvp

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.41 – 7.0.88; 8.0.0 – 8.0.52; 8.5.0 – 8.5.31; 9.0.0 – 9.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*9.0.0 milestone1VulnerableApache
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*17.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*9.4VulnerableNetApp
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.41 – 7.0.88; 8.0.0 – 8.0.52; 8.5.0 – 8.5.31; 9.0.0 – 9.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* Versions 17.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.4 Vulnerable ·NetApp
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*7.3VulnerableNetApp
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·NetApp
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · GHSA-r4x2-3cq5-hqvp org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.9 Advisory →
  • Fix · GHSA-r4x2-3cq5-hqvp org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.32 Advisory →
  • Fix · GHSA-r4x2-3cq5-hqvp org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.0.53 Advisory →
  • Fix · GHSA-r4x2-3cq5-hqvp org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.88 Advisory →

Red Hat 7 advisories

  • RHSA-2019:2205 Released 2019-08-06 · Red Hat rating Moderate
    tomcat security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-9.el7, tomcat-servlet-3.0-api-7.0.76-9.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-9.el7, tomcat-servlet-3.0-api-7.0.76-9.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-el-2.2-api-7.0.76-9.el7 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-el-2.2-api-7.0.76-9.el7 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-9.el7, tomcat-javadoc-7.0.76-9.el7, tomcat-jsvc-7.0.76-9.el7
  • RHSA-2019:1529 Released 2019-06-18 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6 +47
  • RHSA-2019:0451 Released 2019-03-04 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.0 Service Pack 2 security and bug fix update
    • Red Hat JBoss Web Server 5.0 for RHEL 6 Server jws5-ecj-4.6.1-6.redhat_1.1.el6jws, jws5-javapackages-tools-3.4.1-5.15.10.el6jws, jws5-jboss-logging-3.3.1-5.Final_redhat_1.1.el6jws +17
    • Red Hat JBoss Web Server 5.0 for RHEL 7 Server jws5-ecj-4.6.1-6.redhat_1.1.el7jws, jws5-javapackages-tools-3.4.1-5.15.10.el7jws, jws5-jboss-logging-3.3.1-5.Final_redhat_1.1.el7jws +17
Show 4 more Red Hat advisories
  • RHSA-2019:0450 Released 2019-03-04 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.0 Service Pack 2 security and bug fix update
    • Red Hat JBoss Web Server 5.0
  • RHSA-2018:3768 Released 2018-12-04 · Red Hat rating Important
    Red Hat Fuse 7.2 security update
    • Red Hat Fuse 7.2
  • RHSA-2018:2469 Released 2018-08-16 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.17-17.redhat_17.ep7.el6, tomcat7-7.0.70-27.ep7.el6, tomcat7-admin-webapps-7.0.70-27.ep7.el6 +22
    • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.17-17.redhat_17.ep7.el7, tomcat7-7.0.70-27.ep7.el7, tomcat7-admin-webapps-7.0.70-27.ep7.el7 +22
  • RHSA-2018:2470 Released 2018-08-16 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update
    • Red Hat JBoss Web Server 3.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Integration Service 2AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:1529
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2205
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:2205
Red Hat Fuse 7.2Fixed RHSA-2018:3768
Red Hat JBoss Web Server 3.1Fixed RHSA-2018:2470
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2018:2469
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2018:2469
Red Hat JBoss Web Server 5.0Fixed RHSA-2019:0450
Red Hat JBoss Web Server 5.0 for RHEL 6 ServerFixed RHSA-2019:0451
Red Hat JBoss Web Server 5.0 for RHEL 7 ServerFixed RHSA-2019:0451
Not affected: 12 products
  • Red Hat BPM Suite 6
  • Red Hat Enterprise Linux 6
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat JBoss Operations Network 3
  • Red Hat JBoss SOA Platform 5
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8014
  2. 2026-10-03 Alias added: GHSA-r4x2-3cq5-hqvp
  3. 2026-10-16 CISA SSVC decision points changed

References

Patch 2

Advisory 15

Other 49

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences