CVE-2017-7674

Published: Aug 11, 2017Modified: May 13, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Affected (123)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

123 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 7.0.41
Apache Tomcat	Version 7.0.42
Apache Tomcat	Version 7.0.43
Apache Tomcat	Version 7.0.44
Apache Tomcat	Version 7.0.45
Apache Tomcat	Version 7.0.46
Apache Tomcat	Version 7.0.47
Apache Tomcat	Version 7.0.48
Apache Tomcat	Version 7.0.49
Apache Tomcat	Version 7.0.50
Apache Tomcat	Version 7.0.52
Apache Tomcat	Version 7.0.53
Apache Tomcat	Version 7.0.54
Apache Tomcat	Version 7.0.55
Apache Tomcat	Version 7.0.56
Apache Tomcat	Version 7.0.57
Apache Tomcat	Version 7.0.58
Apache Tomcat	Version 7.0.59
Apache Tomcat	Version 7.0.60
Apache Tomcat	Version 7.0.61
Apache Tomcat	Version 7.0.62
Apache Tomcat	Version 7.0.63
Apache Tomcat	Version 7.0.64
Apache Tomcat	Version 7.0.65
Apache Tomcat	Version 7.0.66
Apache Tomcat	Version 7.0.67
Apache Tomcat	Version 7.0.68
Apache Tomcat	Version 7.0.69
Apache Tomcat	Version 7.0.70
Apache Tomcat	Version 7.0.71
Apache Tomcat	Version 7.0.72
Apache Tomcat	Version 7.0.73
Apache Tomcat	Version 7.0.74
Apache Tomcat	Version 7.0.75
Apache Tomcat	Version 7.0.76
Apache Tomcat	Version 7.0.77
Apache Tomcat	Version 7.0.78
Apache Tomcat	Version 8.0.0 rc10
Apache Tomcat	Version 8.0.0 rc1
Apache Tomcat	Version 8.0.0 rc3
Apache Tomcat	Version 8.0.0 rc5
Apache Tomcat	Version 8.0.10
Apache Tomcat	Version 8.0.11
Apache Tomcat	Version 8.0.12
Apache Tomcat	Version 8.0.13
Apache Tomcat	Version 8.0.14
Apache Tomcat	Version 8.0.15
Apache Tomcat	Version 8.0.16
Apache Tomcat	Version 8.0.17
Apache Tomcat	Version 8.0.18
Apache Tomcat	Version 8.0.19
Apache Tomcat	Version 8.0.1
Apache Tomcat	Version 8.0.20
Apache Tomcat	Version 8.0.21
Apache Tomcat	Version 8.0.22
Apache Tomcat	Version 8.0.23
Apache Tomcat	Version 8.0.24
Apache Tomcat	Version 8.0.25
Apache Tomcat	Version 8.0.26
Apache Tomcat	Version 8.0.27
Apache Tomcat	Version 8.0.28
Apache Tomcat	Version 8.0.29
Apache Tomcat	Version 8.0.2
Apache Tomcat	Version 8.0.30
Apache Tomcat	Version 8.0.31
Apache Tomcat	Version 8.0.32
Apache Tomcat	Version 8.0.33
Apache Tomcat	Version 8.0.34
Apache Tomcat	Version 8.0.35
Apache Tomcat	Version 8.0.36
Apache Tomcat	Version 8.0.37
Apache Tomcat	Version 8.0.38
Apache Tomcat	Version 8.0.39
Apache Tomcat	Version 8.0.3
Apache Tomcat	Version 8.0.40
Apache Tomcat	Version 8.0.41
Apache Tomcat	Version 8.0.42
Apache Tomcat	Version 8.0.43
Apache Tomcat	Version 8.0.44
Apache Tomcat	Version 8.0.4
Apache Tomcat	Version 8.0.5
Apache Tomcat	Version 8.0.6
Apache Tomcat	Version 8.0.7
Apache Tomcat	Version 8.0.8
Apache Tomcat	Version 8.0.9
Apache Tomcat	Version 8.0
Apache Tomcat	Version 8.5.0
Apache Tomcat	Version 8.5.10
Apache Tomcat	Version 8.5.11
Apache Tomcat	Version 8.5.12
Apache Tomcat	Version 8.5.13
Apache Tomcat	Version 8.5.14
Apache Tomcat	Version 8.5.15
Apache Tomcat	Version 8.5.1
Apache Tomcat	Version 8.5.2
Apache Tomcat	Version 8.5.3
Apache Tomcat	Version 8.5.4
Apache Tomcat	Version 8.5.5
Apache Tomcat	Version 8.5.6
Apache Tomcat	Version 8.5.7
Apache Tomcat	Version 8.5.8
Apache Tomcat	Version 8.5.9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (58)

http://www.debian.org/security/2017/dsa-3974

Source: security@apache.org

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: security@apache.org

http://www.securityfocus.com/bid/100280

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1801

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:1802

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3081

Source: security@apache.org

https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20180614-0003/

Source: security@apache.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us

Source: security@apache.org

http://www.debian.org/security/2017/dsa-3974