SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins.

CRITICAL 9.8EPSS 21.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 21.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

CVSS 3.0
9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
21.72% probability · 97th percentile
CISA KEV
Not listed
Weakness
CWE-1188
Affected
apache/tomcat · canonical/ubuntu linux · debian/debian linux · netapp/oncommand insight · netapp/oncommand unified manager · netapp/oncommand workflow automation · netapp/snapcenter server · netapp/storage automation store
Source
security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.