9.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2017-5648

CVE-2017-5648: Exposure of Resource to Wrong Sphere in Apache Tomcat

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2017-5648

CVE-2017-5648:

9.1

CVSS Score

3.0

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.tomcat:tomcat-catalina	maven	>= 9.0.0.M1, <= 9.0.0.M17	9.0.0.M18
org.apache.tomcat:tomcat-catalina	maven	>= 8.5.0, <= 8.5.12	8.5.13
org.apache.tomcat:tomcat-catalina	maven	>= 8.0.0, <= 8.0.41	8.0.42
org.apache.tomcat:tomcat-catalina	maven	>= 7.0.0, <= 7.0.75	7.0.76
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 9.0.0.M1, <= 9.0.0.M17	9.0.0.M18
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 8.5.0, <= 8.5.12	8.5.13
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 8.0.0, <= 8.0.41	8.0.42
org.apache.tomcat.embed:tomcat-embed-core	maven	>= 7.0.0, <= 7.0.75	7.0.76

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.