CVE-2013-4590
Summary
| CVE | CVE-2013-4590 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-02-26 14:55:08 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 0.009220000 probability, percentile 0.760760000 (date 2026-05-05)
Problem Types: CWE-200 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | 1.1.3 | All | All | All |
| Application | Apache | Tomcat | 3.0 | All | All | All |
| Application | Apache | Tomcat | 3.1 | All | All | All |
| Application | Apache | Tomcat | 3.1.1 | All | All | All |
| Application | Apache | Tomcat | 3.2 | All | All | All |
| Application | Apache | Tomcat | 3.2.1 | All | All | All |
| Application | Apache | Tomcat | 3.2.2 | All | All | All |
| Application | Apache | Tomcat | 3.2.2 | beta2 | All | All |
| Application | Apache | Tomcat | 3.2.3 | All | All | All |
| Application | Apache | Tomcat | 3.2.4 | All | All | All |
| Application | Apache | Tomcat | 3.3 | All | All | All |
| Application | Apache | Tomcat | 3.3.1 | All | All | All |
| Application | Apache | Tomcat | 3.3.1a | All | All | All |
| Application | Apache | Tomcat | 3.3.2 | All | All | All |
| Application | Apache | Tomcat | 4 | All | All | All |
| Application | Apache | Tomcat | 4.0.0 | All | All | All |
| Application | Apache | Tomcat | 4.0.1 | All | All | All |
| Application | Apache | Tomcat | 4.0.2 | All | All | All |
| Application | Apache | Tomcat | 4.0.3 | All | All | All |
| Application | Apache | Tomcat | 4.0.4 | All | All | All |
| Application | Apache | Tomcat | 4.0.5 | All | All | All |
| Application | Apache | Tomcat | 4.0.6 | All | All | All |
| Application | Apache | Tomcat | 4.1.0 | All | All | All |
| Application | Apache | Tomcat | 4.1.1 | All | All | All |
| Application | Apache | Tomcat | 4.1.10 | All | All | All |
| Application | Apache | Tomcat | 4.1.12 | All | All | All |
| Application | Apache | Tomcat | 4.1.15 | All | All | All |
| Application | Apache | Tomcat | 4.1.2 | All | All | All |
| Application | Apache | Tomcat | 4.1.24 | All | All | All |
| Application | Apache | Tomcat | 4.1.28 | All | All | All |
| Application | Apache | Tomcat | 4.1.29 | All | All | All |
| Application | Apache | Tomcat | 4.1.3 | All | All | All |
| Application | Apache | Tomcat | 4.1.3 | beta | All | All |
| Application | Apache | Tomcat | 4.1.31 | All | All | All |
| Application | Apache | Tomcat | 4.1.36 | All | All | All |
| Application | Apache | Tomcat | 4.1.9 | beta | All | All |
| Application | Apache | Tomcat | 5 | All | All | All |
| Application | Apache | Tomcat | 5.0.0 | All | All | All |
| Application | Apache | Tomcat | 5.0.1 | All | All | All |
| Application | Apache | Tomcat | 5.0.10 | All | All | All |
| Application | Apache | Tomcat | 5.0.11 | All | All | All |
| Application | Apache | Tomcat | 5.0.12 | All | All | All |
| Application | Apache | Tomcat | 5.0.13 | All | All | All |
| Application | Apache | Tomcat | 5.0.14 | All | All | All |
| Application | Apache | Tomcat | 5.0.15 | All | All | All |
| Application | Apache | Tomcat | 5.0.16 | All | All | All |
| Application | Apache | Tomcat | 5.0.17 | All | All | All |
| Application | Apache | Tomcat | 5.0.18 | All | All | All |
| Application | Apache | Tomcat | 5.0.19 | All | All | All |
| Application | Apache | Tomcat | 5.0.2 | All | All | All |
| Application | Apache | Tomcat | 5.0.21 | All | All | All |
| Application | Apache | Tomcat | 5.0.22 | All | All | All |
| Application | Apache | Tomcat | 5.0.23 | All | All | All |
| Application | Apache | Tomcat | 5.0.24 | All | All | All |
| Application | Apache | Tomcat | 5.0.25 | All | All | All |
| Application | Apache | Tomcat | 5.0.26 | All | All | All |
| Application | Apache | Tomcat | 5.0.27 | All | All | All |
| Application | Apache | Tomcat | 5.0.28 | All | All | All |
| Application | Apache | Tomcat | 5.0.29 | All | All | All |
| Application | Apache | Tomcat | 5.0.3 | All | All | All |
| Application | Apache | Tomcat | 5.0.30 | All | All | All |
| Application | Apache | Tomcat | 5.0.4 | All | All | All |
| Application | Apache | Tomcat | 5.0.5 | All | All | All |
| Application | Apache | Tomcat | 5.0.6 | All | All | All |
| Application | Apache | Tomcat | 5.0.7 | All | All | All |
| Application | Apache | Tomcat | 5.0.8 | All | All | All |
| Application | Apache | Tomcat | 5.0.9 | All | All | All |
| Application | Apache | Tomcat | 5.5.0 | All | All | All |
| Application | Apache | Tomcat | 5.5.1 | All | All | All |
| Application | Apache | Tomcat | 5.5.10 | All | All | All |
| Application | Apache | Tomcat | 5.5.11 | All | All | All |
| Application | Apache | Tomcat | 5.5.12 | All | All | All |
| Application | Apache | Tomcat | 5.5.13 | All | All | All |
| Application | Apache | Tomcat | 5.5.14 | All | All | All |
| Application | Apache | Tomcat | 5.5.15 | All | All | All |
| Application | Apache | Tomcat | 5.5.16 | All | All | All |
| Application | Apache | Tomcat | 5.5.17 | All | All | All |
| Application | Apache | Tomcat | 5.5.18 | All | All | All |
| Application | Apache | Tomcat | 5.5.19 | All | All | All |
| Application | Apache | Tomcat | 5.5.2 | All | All | All |
| Application | Apache | Tomcat | 5.5.20 | All | All | All |
| Application | Apache | Tomcat | 5.5.21 | All | All | All |
| Application | Apache | Tomcat | 5.5.22 | All | All | All |
| Application | Apache | Tomcat | 5.5.23 | All | All | All |
| Application | Apache | Tomcat | 5.5.24 | All | All | All |
| Application | Apache | Tomcat | 5.5.25 | All | All | All |
| Application | Apache | Tomcat | 5.5.26 | All | All | All |
| Application | Apache | Tomcat | 5.5.27 | All | All | All |
| Application | Apache | Tomcat | 5.5.28 | All | All | All |
| Application | Apache | Tomcat | 5.5.29 | All | All | All |
| Application | Apache | Tomcat | 5.5.3 | All | All | All |
| Application | Apache | Tomcat | 5.5.30 | All | All | All |
| Application | Apache | Tomcat | 5.5.31 | All | All | All |
| Application | Apache | Tomcat | 5.5.32 | All | All | All |
| Application | Apache | Tomcat | 5.5.33 | All | All | All |
| Application | Apache | Tomcat | 5.5.34 | All | All | All |
| Application | Apache | Tomcat | 5.5.35 | All | All | All |
| Application | Apache | Tomcat | 5.5.4 | All | All | All |
| Application | Apache | Tomcat | 5.5.5 | All | All | All |
| Application | Apache | Tomcat | 5.5.6 | All | All | All |
| Application | Apache | Tomcat | 5.5.7 | All | All | All |
| Application | Apache | Tomcat | 5.5.8 | All | All | All |
| Application | Apache | Tomcat | 5.5.9 | All | All | All |
| Application | Apache | Tomcat | 6 | All | All | All |
| Application | Apache | Tomcat | 6.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.0 | alpha | All | All |
| Application | Apache | Tomcat | 6.0.1 | All | All | All |
| Application | Apache | Tomcat | 6.0.1 | alpha | All | All |
| Application | Apache | Tomcat | 6.0.10 | All | All | All |
| Application | Apache | Tomcat | 6.0.11 | All | All | All |
| Application | Apache | Tomcat | 6.0.12 | All | All | All |
| Application | Apache | Tomcat | 6.0.13 | All | All | All |
| Application | Apache | Tomcat | 6.0.14 | All | All | All |
| Application | Apache | Tomcat | 6.0.15 | All | All | All |
| Application | Apache | Tomcat | 6.0.16 | All | All | All |
| Application | Apache | Tomcat | 6.0.17 | All | All | All |
| Application | Apache | Tomcat | 6.0.18 | All | All | All |
| Application | Apache | Tomcat | 6.0.19 | All | All | All |
| Application | Apache | Tomcat | 6.0.2 | All | All | All |
| Application | Apache | Tomcat | 6.0.2 | alpha | All | All |
| Application | Apache | Tomcat | 6.0.2 | beta | All | All |
| Application | Apache | Tomcat | 6.0.20 | All | All | All |
| Application | Apache | Tomcat | 6.0.24 | All | All | All |
| Application | Apache | Tomcat | 6.0.26 | All | All | All |
| Application | Apache | Tomcat | 6.0.27 | All | All | All |
| Application | Apache | Tomcat | 6.0.28 | All | All | All |
| Application | Apache | Tomcat | 6.0.29 | All | All | All |
| Application | Apache | Tomcat | 6.0.3 | All | All | All |
| Application | Apache | Tomcat | 6.0.30 | All | All | All |
| Application | Apache | Tomcat | 6.0.31 | All | All | All |
| Application | Apache | Tomcat | 6.0.32 | All | All | All |
| Application | Apache | Tomcat | 6.0.33 | All | All | All |
| Application | Apache | Tomcat | 6.0.35 | All | All | All |
| Application | Apache | Tomcat | 6.0.36 | All | All | All |
| Application | Apache | Tomcat | 7.0.0 | All | All | All |
| Application | Apache | Tomcat | 7.0.0 | beta | All | All |
| Application | Apache | Tomcat | 7.0.1 | All | All | All |
| Application | Apache | Tomcat | 7.0.10 | All | All | All |
| Application | Apache | Tomcat | 7.0.11 | All | All | All |
| Application | Apache | Tomcat | 7.0.12 | All | All | All |
| Application | Apache | Tomcat | 7.0.13 | All | All | All |
| Application | Apache | Tomcat | 7.0.14 | All | All | All |
| Application | Apache | Tomcat | 7.0.15 | All | All | All |
| Application | Apache | Tomcat | 7.0.16 | All | All | All |
| Application | Apache | Tomcat | 7.0.17 | All | All | All |
| Application | Apache | Tomcat | 7.0.18 | All | All | All |
| Application | Apache | Tomcat | 7.0.19 | All | All | All |
| Application | Apache | Tomcat | 7.0.2 | All | All | All |
| Application | Apache | Tomcat | 7.0.2 | beta | All | All |
| Application | Apache | Tomcat | 7.0.20 | All | All | All |
| Application | Apache | Tomcat | 7.0.21 | All | All | All |
| Application | Apache | Tomcat | 7.0.22 | All | All | All |
| Application | Apache | Tomcat | 7.0.23 | All | All | All |
| Application | Apache | Tomcat | 7.0.24 | All | All | All |
| Application | Apache | Tomcat | 7.0.25 | All | All | All |
| Application | Apache | Tomcat | 7.0.26 | All | All | All |
| Application | Apache | Tomcat | 7.0.27 | All | All | All |
| Application | Apache | Tomcat | 7.0.28 | All | All | All |
| Application | Apache | Tomcat | 7.0.29 | All | All | All |
| Application | Apache | Tomcat | 7.0.3 | All | All | All |
| Application | Apache | Tomcat | 7.0.30 | All | All | All |
| Application | Apache | Tomcat | 7.0.31 | All | All | All |
| Application | Apache | Tomcat | 7.0.32 | All | All | All |
| Application | Apache | Tomcat | 7.0.33 | All | All | All |
| Application | Apache | Tomcat | 7.0.34 | All | All | All |
| Application | Apache | Tomcat | 7.0.35 | All | All | All |
| Application | Apache | Tomcat | 7.0.36 | All | All | All |
| Application | Apache | Tomcat | 7.0.37 | All | All | All |
| Application | Apache | Tomcat | 7.0.38 | All | All | All |
| Application | Apache | Tomcat | 7.0.39 | All | All | All |
| Application | Apache | Tomcat | 7.0.4 | All | All | All |
| Application | Apache | Tomcat | 7.0.4 | beta | All | All |
| Application | Apache | Tomcat | 7.0.40 | All | All | All |
| Application | Apache | Tomcat | 7.0.41 | All | All | All |
| Application | Apache | Tomcat | 7.0.42 | All | All | All |
| Application | Apache | Tomcat | 7.0.43 | All | All | All |
| Application | Apache | Tomcat | 7.0.44 | All | All | All |
| Application | Apache | Tomcat | 7.0.45 | All | All | All |
| Application | Apache | Tomcat | 7.0.46 | All | All | All |
| Application | Apache | Tomcat | 7.0.50 | All | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc1 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc2 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc3 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc4 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc5 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc6 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc7 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc8 | All | All |
| Application | Apache | Tomcat | 8.0.0 | rc9 | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Oracle | Solaris | 11.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory SA59724 - IBM Rational Test Workbench / Virtualization Server Apache Tomcat Two Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Permissions Required, Third Party Advisory |
| Security Advisory SA59036 - IBM QRadar SIEM Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Permissions Required, Third Party Advisory |
| [Apache-SVN] Revision 1558828 | af854a3a-2127-422b-91ae-364da2661108 | svn.apache.org | Issue Tracking |
| Document Display | HPE Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20564.www2.hpe.com | |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Permissions Required, Third Party Advisory |
| Oracle Critical Patch Update - October 2016 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| Apache Tomcat® - Apache Tomcat 8 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| Oracle Critical Patch Update - October 2014 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| IBM Security Bulletin: Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerablity (CVE-2013-4286, CVE-2013-4322, CVE-2013-4590) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Apache Tomcat® - Apache Tomcat 7 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| Mageia Advisory: MGASA-2014-0148 - Updated tomcat package fixes security vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | advisories.mageia.org | Third Party Advisory |
| Support / Security / Advisories / / MDVSA-2015:052 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Third Party Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| VMSA-2014-0008.2 | United States | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | |
| Support / Security / Advisories / / MDVSA-2015:084 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Third Party Advisory |
| Bug 1069911 – CVE-2013-4590 tomcat: information disclosure via XXE when running untrusted web applications | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Apache Tomcat® - Apache Tomcat 6 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| Debian -- Security Information -- DSA-3530-1 tomcat6 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| '[security bulletin] HPSBOV03503 rev.1 - HP OpenVMS CSWS_JAVA running Tomcat, Multiple Remote Vulnera' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List |
| Security Advisory SA59722 - IBM Rational Connector for SAP Solution Manager Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Permissions Required, Third Party Advisory |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| [Apache-SVN] Revision 1549529 | af854a3a-2127-422b-91ae-364da2661108 | svn.apache.org | Issue Tracking |
| IBM Security Bulletin: Multiple vulnerabilities in Apache Tomcat used by IBM QRadar Security Information and Event Manager 7.1 MR2, and 7.2 MR2. (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| IBM Security Bulletin: Rational Lifecycle Adapter for HP ALM Apache Tomcat fix (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590, CVE-2014-0075, CVE-2014-0095, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| [Apache-SVN] Revision 1549528 | af854a3a-2127-422b-91ae-364da2661108 | svn.apache.org | Issue Tracking |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.