Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability

Bugtraq ID:	104203
Class:	Unknown
CVE:	CVE-2018-8014
Remote:	Yes
Local:	No
Published:	May 15 2018 12:00AM
Updated:	Nov 08 2018 05:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Oracle MySQL Enterprise Monitor 3.2.1182 Oracle MySQL Enterprise Monitor 3.0.22 Oracle MySQL Enterprise Monitor 3.0.20 Oracle MySQL Enterprise Monitor 3.0.18 Oracle MySQL Enterprise Monitor 3.0.10 Oracle MySQL Enterprise Monitor 3.0.9 Oracle MySQL Enterprise Monitor 3.0.8 Oracle MySQL Enterprise Monitor 3.0 Oracle MySQL Enterprise Monitor 2.3.20 Oracle MySQL Enterprise Monitor 2.3.19 Oracle MySQL Enterprise Monitor 2.3.16 Oracle MySQL Enterprise Monitor 2.3.15 Oracle MySQL Enterprise Monitor 2.3.14 Oracle MySQL Enterprise Monitor 2.3.13 Oracle MySQL Enterprise Monitor 8.0.2.8191 Oracle MySQL Enterprise Monitor 8.0.0.8131 Oracle MySQL Enterprise Monitor 4.0.6.5281 Oracle MySQL Enterprise Monitor 4.0.4.5235 Oracle MySQL Enterprise Monitor 4.0.2.5168 Oracle MySQL Enterprise Monitor 4.0.0.5135 Oracle MySQL Enterprise Monitor 3.4.9.4237 Oracle MySQL Enterprise Monitor 3.4.7.4297 Oracle MySQL Enterprise Monitor 3.4.5.4248 Oracle MySQL Enterprise Monitor 3.4.4.4226 Oracle MySQL Enterprise Monitor 3.4.2.4181 Oracle MySQL Enterprise Monitor 3.4.1 Oracle MySQL Enterprise Monitor 3.4.0 Oracle MySQL Enterprise Monitor 3.3.7.3306 Oracle MySQL Enterprise Monitor 3.3.6.3293 Oracle MySQL Enterprise Monitor 3.3.4.3247 Oracle MySQL Enterprise Monitor 3.3.3.1199 Oracle MySQL Enterprise Monitor 3.3.2.1162 Oracle MySQL Enterprise Monitor 3.3.0.1098 Oracle MySQL Enterprise Monitor 3.2.8.2223 Oracle MySQL Enterprise Monitor 3.2.7.1204 Oracle MySQL Enterprise Monitor 3.2.5.1141 Oracle MySQL Enterprise Monitor 3.2.4.1102 Oracle MySQL Enterprise Monitor 3.2.1.1049 Oracle MySQL Enterprise Monitor 3.1.6.8003 Oracle MySQL Enterprise Monitor 3.1.5.7958 Oracle MySQL Enterprise Monitor 3.1.4.7895 Oracle MySQL Enterprise Monitor 3.1.3.7856 Oracle MySQL Enterprise Monitor 3.1.2 Oracle MySQL Enterprise Monitor 3.0.4 Oracle MySQL Enterprise Monitor 3.0.25 Oracle MySQL Enterprise Monitor 3.0 Oracle MySQL Enterprise Monitor 2.3 Bluecoat Director 6.1 Apache Tomcat 9.0.8 Apache Tomcat 9.0.5 Apache Tomcat 9.0.4 Apache Tomcat 9.0.1 Apache Tomcat 8.5.31 Apache Tomcat 8.5.28 Apache Tomcat 8.5.27 Apache Tomcat 8.5.23 Apache Tomcat 8.5.16 Apache Tomcat 8.5.15 Apache Tomcat 8.5.14 Apache Tomcat 8.5.13 Apache Tomcat 8.5.12 Apache Tomcat 8.5.11 Apache Tomcat 8.5.9 Apache Tomcat 8.5.8 Apache Tomcat 8.5.7 Apache Tomcat 8.5.6 Apache Tomcat 8.5.5 Apache Tomcat 8.5.4 Apache Tomcat 8.5.1 Apache Tomcat 8.0.52 Apache Tomcat 8.0.50 Apache Tomcat 8.0.49 Apache Tomcat 8.0.47 Apache Tomcat 8.0.45 Apache Tomcat 8.0.44 Apache Tomcat 8.0.43 Apache Tomcat 8.0.42 Apache Tomcat 8.0.41 Apache Tomcat 8.0.40 Apache Tomcat 8.0.39 Apache Tomcat 8.0.38 Apache Tomcat 8.0.37 Apache Tomcat 8.0.36 Apache Tomcat 8.0.35 Apache Tomcat 8.0.34 Apache Tomcat 8.0.33 Apache Tomcat 8.0.30 Apache Tomcat 8.0.27 Apache Tomcat 8.0.19 Apache Tomcat 8.0.17 Apache Tomcat 8.0.15 Apache Tomcat 8.0.5 Apache Tomcat 8.0.3 Apache Tomcat 8.0.1 Apache Tomcat 7.0.88 Apache Tomcat 7.0.85 Apache Tomcat 7.0.84 Apache Tomcat 7.0.82 Apache Tomcat 7.0.81 Apache Tomcat 7.0.80 Apache Tomcat 7.0.79 Apache Tomcat 7.0.78 Apache Tomcat 7.0.77 Apache Tomcat 7.0.76 Apache Tomcat 7.0.75 Apache Tomcat 7.0.74 Apache Tomcat 7.0.73 Apache Tomcat 7.0.72 Apache Tomcat 7.0.70 Apache Tomcat 7.0.69 Apache Tomcat 7.0.67 Apache Tomcat 7.0.65 Apache Tomcat 7.0.60 Apache Tomcat 7.0.59 Apache Tomcat 7.0.57 Apache Tomcat 7.0.54 Apache Tomcat 7.0.53 Apache Tomcat 7.0.50 Apache Tomcat 9.0.0.M9 Apache Tomcat 9.0.0.M7 Apache Tomcat 9.0.0.M5 Apache Tomcat 9.0.0.M4 Apache Tomcat 9.0.0.M3 Apache Tomcat 9.0.0.M22 Apache Tomcat 9.0.0.M21 Apache Tomcat 9.0.0.M20 Apache Tomcat 9.0.0.M2 Apache Tomcat 9.0.0.M19 Apache Tomcat 9.0.0.M18 Apache Tomcat 9.0.0.M17 Apache Tomcat 9.0.0.M15 Apache Tomcat 9.0.0.M13 Apache Tomcat 9.0.0.M12 Apache Tomcat 9.0.0.M11 Apache Tomcat 9.0.0.M10 Apache Tomcat 9.0.0.M1 Apache Tomcat 8.5.3 Apache Tomcat 8.5.2 Apache Tomcat 8.5.0 Apache Tomcat 8.0.32 Apache Tomcat 8.0.0.RC1 Apache Tomcat 7.0.68 Apache Tomcat 7.0.55 Apache Tomcat 7.0.49 Apache Tomcat 7.0.48 Apache Tomcat 7.0.47 Apache Tomcat 7.0.46 Apache Tomcat 7.0.45 Apache Tomcat 7.0.44 Apache Tomcat 7.0.43 Apache Tomcat 7.0.42 Apache Tomcat 7.0.41
Not Vulnerable:	Apache Tomcat 9.0.9 Apache Tomcat 8.5.32 Apache Tomcat 8.0.53 Apache Tomcat 7.0.89

Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability

Apache Tomcat is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

The following products are affected:
Apache Tomcat 9.0.0.M1 through 9.0.8
Apache Tomcat 8.5.0 through 8.5.31
Apache Tomcat 8.0.0.RC1 through 8.0.52
Apache Tomcat 7.0.41 through 7.0.88

Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability

References:

• Apache Homepage (Apache)
  
• Apache Tomcat 7.x vulnerabilities (Apache)
  
• Apache Tomcat 8.x vulnerabilities (Apache)
  
• Apache Tomcat 9.x vulnerabilities (Apache)
  
• CVE-2018-8014 Insecure defaults for CORS filter (Apache)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)
  
• SYMSA1463: Apache Tomcat Vulnerabilities Jan-Aug 2018 (Symantec)