CVE-2017-5648

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-5648
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5648.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-5648
Aliases
Downstream
Related
Published
2017-04-17T16:59:00.367Z
Modified
2026-05-15T12:03:04.717855697Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpes": [
                "cpe:2.3:a:apache:tomcat:8.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.40:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.41:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*"
            ],
            "vendor_product": "apache:tomcat",
            "extracted_events": [
                {
                    "last_affected": "8.0.0"
                },
                {
                    "last_affected": "8.0.0-rc1"
                },
                {
                    "last_affected": "8.0.1"
                },
                {
                    "last_affected": "8.0.2"
                },
                {
                    "last_affected": "8.0.3"
                },
                {
                    "last_affected": "8.0.4"
                },
                {
                    "last_affected": "8.0.5"
                },
                {
                    "last_affected": "8.0.6"
                },
                {
                    "last_affected": "8.0.7"
                },
                {
                    "last_affected": "8.0.8"
                },
                {
                    "last_affected": "8.0.9"
                },
                {
                    "last_affected": "8.0.10"
                },
                {
                    "last_affected": "8.0.11"
                },
                {
                    "last_affected": "8.0.12"
                },
                {
                    "last_affected": "8.0.13"
                },
                {
                    "last_affected": "8.0.14"
                },
                {
                    "last_affected": "8.0.15"
                },
                {
                    "last_affected": "8.0.16"
                },
                {
                    "last_affected": "8.0.17"
                },
                {
                    "last_affected": "8.0.18"
                },
                {
                    "last_affected": "8.0.19"
                },
                {
                    "last_affected": "8.0.20"
                },
                {
                    "last_affected": "8.0.21"
                },
                {
                    "last_affected": "8.0.22"
                },
                {
                    "last_affected": "8.0.23"
                },
                {
                    "last_affected": "8.0.24"
                },
                {
                    "last_affected": "8.0.25"
                },
                {
                    "last_affected": "8.0.26"
                },
                {
                    "last_affected": "8.0.27"
                },
                {
                    "last_affected": "8.0.28"
                },
                {
                    "last_affected": "8.0.29"
                },
                {
                    "last_affected": "8.0.30"
                },
                {
                    "last_affected": "8.0.31"
                },
                {
                    "last_affected": "8.0.32"
                },
                {
                    "last_affected": "8.0.33"
                },
                {
                    "last_affected": "8.0.34"
                },
                {
                    "last_affected": "8.0.35"
                },
                {
                    "last_affected": "8.0.36"
                },
                {
                    "last_affected": "8.0.37"
                },
                {
                    "last_affected": "8.0.38"
                },
                {
                    "last_affected": "8.0.39"
                },
                {
                    "last_affected": "8.0.40"
                },
                {
                    "last_affected": "8.0.41"
                }
            ]
        }
    ]
}
References

Affected packages