Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache Tomcat Exposure of Resource to Wrong Sphere Vulnerability - CVE-2017-5648 - Vulnerability Database
Apache Tomcat

Apache Tomcat Exposure of Resource to Wrong Sphere Vulnerability - CVE-2017-5648

Critical
Reference: CVE-2017-5648
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-5648
Title: Apache Tomcat Exposure of Resource to Wrong Sphere Vulnerability
Overview:

While investigating bug 60718 it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17 8.5.0 to 8.5.11 8.0.0.RC1 to 8.0.41 and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.