The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
{
"unresolved_ranges": [
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.0-rc10"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.0-rc1"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.0-rc3"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.0-rc5"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.10"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.11"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.12"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.13"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.14"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.15"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.16"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.17"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.18"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.19"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.1"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.20"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.21"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.22"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.23"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.24"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.25"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.26"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.27"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.28"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.29"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.2"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.30"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.31"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.32"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.33"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.34"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.35"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.36"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.37"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.38"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.39"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.3"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.40:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.40"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.41"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.41:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.42:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.42"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.43:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.43"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.44:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.44"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.4"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.5"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.6"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.7"
}
],
"source": "CPE_FIELD"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*",
"extracted_events": [
{
"last_affected": "8.0.8"
}
],
"source": "CPE_FIELD"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0.9"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpe": "cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*"
}
]
}{
"cpe": [
"cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:7.0.78:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.41"
},
{
"last_affected": "7.0.42"
},
{
"last_affected": "7.0.43"
},
{
"last_affected": "7.0.44"
},
{
"last_affected": "7.0.45"
},
{
"last_affected": "7.0.46"
},
{
"last_affected": "7.0.47"
},
{
"last_affected": "7.0.48"
},
{
"last_affected": "7.0.49"
},
{
"last_affected": "7.0.50"
},
{
"last_affected": "7.0.52"
},
{
"last_affected": "7.0.53"
},
{
"last_affected": "7.0.54"
},
{
"last_affected": "7.0.55"
},
{
"last_affected": "7.0.56"
},
{
"last_affected": "7.0.57"
},
{
"last_affected": "7.0.58"
},
{
"last_affected": "7.0.59"
},
{
"last_affected": "7.0.60"
},
{
"last_affected": "7.0.61"
},
{
"last_affected": "7.0.62"
},
{
"last_affected": "7.0.63"
},
{
"last_affected": "7.0.64"
},
{
"last_affected": "7.0.65"
},
{
"last_affected": "7.0.66"
},
{
"last_affected": "7.0.67"
},
{
"last_affected": "7.0.68"
},
{
"last_affected": "7.0.69"
},
{
"last_affected": "7.0.70"
},
{
"last_affected": "7.0.71"
},
{
"last_affected": "7.0.72"
},
{
"last_affected": "7.0.73"
},
{
"last_affected": "7.0.74"
},
{
"last_affected": "7.0.75"
},
{
"last_affected": "7.0.76"
},
{
"last_affected": "7.0.77"
},
{
"last_affected": "7.0.78"
},
{
"last_affected": "8.5.0"
},
{
"last_affected": "8.5.1"
},
{
"last_affected": "8.5.2"
},
{
"last_affected": "8.5.3"
},
{
"last_affected": "8.5.4"
},
{
"last_affected": "8.5.5"
},
{
"last_affected": "8.5.6"
},
{
"last_affected": "8.5.7"
},
{
"last_affected": "8.5.8"
},
{
"last_affected": "8.5.9"
},
{
"last_affected": "8.5.10"
},
{
"last_affected": "8.5.11"
},
{
"last_affected": "8.5.12"
},
{
"last_affected": "8.5.13"
},
{
"last_affected": "8.5.14"
},
{
"last_affected": "8.5.15"
},
{
"last_affected": "9.0.0-milestone1"
},
{
"last_affected": "9.0.0-milestone10"
},
{
"last_affected": "9.0.0-milestone11"
},
{
"last_affected": "9.0.0-milestone12"
},
{
"last_affected": "9.0.0-milestone13"
},
{
"last_affected": "9.0.0-milestone14"
},
{
"last_affected": "9.0.0-milestone15"
},
{
"last_affected": "9.0.0-milestone16"
},
{
"last_affected": "9.0.0-milestone17"
},
{
"last_affected": "9.0.0-milestone18"
},
{
"last_affected": "9.0.0-milestone19"
},
{
"last_affected": "9.0.0-milestone2"
},
{
"last_affected": "9.0.0-milestone20"
},
{
"last_affected": "9.0.0-milestone21"
},
{
"last_affected": "9.0.0-milestone3"
},
{
"last_affected": "9.0.0-milestone4"
},
{
"last_affected": "9.0.0-milestone5"
},
{
"last_affected": "9.0.0-milestone6"
},
{
"last_affected": "9.0.0-milestone7"
},
{
"last_affected": "9.0.0-milestone8"
},
{
"last_affected": "9.0.0-milestone9"
}
],
"source": "CPE_FIELD"
}