Home

CVE-2017-5648

Description

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

Risk Information

Base Score
9.1
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
19.005

Associated Vulnerability

VulnerabilityOS Platform
Update Tomcat to 9.5.14Windows
Update Tomcat to 9.5.5Windows
Update Tomcat to 9.5.7Windows
Update Tomcat to 9.5.8Windows
Update Tomcat to 9.6.10Windows
Update Tomcat to 9.6.3Windows
Update Tomcat to 9.6.4Windows
Update Tomcat to 9.6.7Windows
Update Tomcat to 9.6.8Windows
Update Tomcat to 2.4.5Windows
Update Tomcat to 3.0.14Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina 9.0.0Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina 8.5.13Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina 8.0.42Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina 7.0.76Windows
Vulnerabilities CVE-2017-5651,CVE-2017-5648 are fixed in Apache - tomcat-embed-core 8.5.13Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core 9.0.0Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core 8.0.42Windows
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core 7.0.76Windows
Servlet and JSP engine (USN-3519-1) tomcat7_7.0.52-1ubuntu0.13_all.debLinux
Servlet and JSP engine (USN-3519-1) tomcat8_8.0.32-1ubuntu1.5_all.debLinux
Servlet and JSP engine (USN-3519-1) tomcat8_8.0.38-2ubuntu2.2_all.debLinux
Servlet and JSP engine (USN-3519-1) libtomcat7-java_7.0.52-1ubuntu0.13_all.debLinux
Servlet and JSP engine (USN-3519-1) libtomcat8-java_8.0.32-1ubuntu1.5_all.debLinux
Servlet and JSP engine (USN-3519-1) libtomcat8-java_8.0.38-2ubuntu2.2_all.debLinux
tomcat7 security update(DSA-3842-1) tomcat7_7.0.56-3+deb8u10_all.debLinux
tomcat8 security update(DSA-3843-1) tomcat8_8.0.14-1+deb8u9_all.debLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-admin-webapps-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-docs-webapp-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-el-3_0-api-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-javadoc-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-jsp-2_3-api-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-lib-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-servlet-3_1-api-8.0.43-10.19.1.noarch.rpmLinux
SUSE-SU-2017:1382-1(SUSE Linux Enterprise Server 12-SP1 ) tomcat-webapps-8.0.43-10.19.1.noarch.rpmLinux
Update Tomcat to 9.5.14 (For Linux)Linux
Update Tomcat to 9.5.5 (For Linux)Linux
Update Tomcat to 9.5.7 (For Linux)Linux
Update Tomcat to 9.5.8 (For Linux)Linux
Update Tomcat to 9.6.10 (For Linux)Linux
Update Tomcat to 9.6.3 (For Linux)Linux
Update Tomcat to 9.6.4 (For Linux)Linux
Update Tomcat to 9.6.7 (For Linux)Linux
Update Tomcat to 9.6.8 (For Linux)Linux
Update Tomcat to 2.4.5 (For Linux)Linux
Update Tomcat to 3.0.14 (For Linux)Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina for Linux 9.0.0Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina for Linux 8.5.13Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina for Linux 8.0.42Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache-tomcat-catalina for Linux 7.0.76Linux
Vulnerabilities CVE-2017-5651,CVE-2017-5648 are fixed in Apache - tomcat-embed-core for Linux 8.5.13Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core for Linux 9.0.0Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core for Linux 8.0.42Linux
Vulnerabilities CVE-2017-5648 are fixed in Apache - tomcat-embed-core for Linux 7.0.76Linux
Exposure of Resource to Wrong Sphere Vulnerability (CVE-2017-5648)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234