Vulnerability Description
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | 7.0.41 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-3974
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.securityfocus.com/bid/100280Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
- https://access.redhat.com/errata/RHSA-2017:3081
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55a
- https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e8
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f9
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b13
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77
FAQ
What is CVE-2017-7674?
CVE-2017-7674 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origi...
How severe is CVE-2017-7674?
CVE-2017-7674 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-7674?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.