Vulnerability Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 7.0.41, <= 7.0.88 |
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 8.0 |
| Netapp | Oncommand Insight | - |
| Netapp | Oncommand Unified Manager | >= 9.4 |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Snapcenter Server | - |
| Netapp | Storage Automation Store | - |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://tomcat.apache.org/security-8.htmlVendor Advisory
- http://tomcat.apache.org/security-9.htmlVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatchThird Party Advisory
- http://www.securityfocus.com/bid/104203Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040998Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041888Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2469Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2470Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0450Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0451Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55a
FAQ
What is CVE-2018-8014?
CVE-2018-8014 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all orig...
How severe is CVE-2018-8014?
CVE-2018-8014 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-8014?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Oncommand Insight, Netapp Oncommand Unified Manager.