KLA11203 Multiple vulnerabilities in Apache Tomcat

Multiple serious vulnerabilities have been found in Apache Tomcat. Malicious users can exploit these vulnerabilities to bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A vulnerability related to security constraints defined by annotations of Servlets can be exploited remotely to bypass security restrictions;
2. A vulnerability related URL patterns can be exploited remotely to bypass security restrictions via URL pattern of “”(empty string).

Original advisories

Apache Tomcat 8.x Security Vulnerabilities

Apache Tomcat 9.x Security Vulnerabilities

Apache Tomcat 7.x Security Vulnerabilities

Related products

Apache-Tomcat

CVE list

CVE-2018-1304 warning

CVE-2018-1305 warning

Solution

Update to the latest versionDownload Tomcat 9Download Tomcat 8

Download Tomcat 7

Impacts

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Apache Tomcat, versions from 7.0.0 to 7.0.84Apache Tomcat, versions from 8.0.0 to 8.0.49Apache Tomcat, versions from 9.0.0 to 9.0.4