Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

References

bugzilla.redhat.com/show_bug.cgi?id=1548282

tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85

ubuntucve 1

f5 1

cve 1

prion 1

debiancve 1

nvd 1

seebug 1

cvelist 1

osv 6

veracode 1

github 1

debian 5