Critical Β· published April 17, 2017
β οΈ A sneaky oversight in Apache Tomcat lets untrusted applications snoop on each other! Itβs like letting a guest in your hotel peek into other rooms without permission. π¨ Think of it as a poorly designed hotel where guests can wander into rooms that arenβt theirs. If an untrusted application is given access, it could potentially peek at or even mess with another application's data, compromising privacy and security. An untrusted application could access and modify information from other web applications running on the same server, leading to data leaks or unauthorized access. This could result in sensitive information being exposed or altered, which is absolutely devastating for web security! β‘
Think of it as a poorly designed hotel where guests can wander into rooms that arenβt theirs. If an untrusted application is given access, it could potentially peek at or even mess with another application's data, compromising privacy and security. This vulnerability arises due to some calls to application listeners not using the appropriate facade object, allowing untrusted apps to retain references to request or response objects. This results in a breach of isolation between web applications running under a SecurityManager.
An untrusted application could access and modify information from other web applications running on the same server, leading to data leaks or unauthorized access. This could result in sensitive information being exposed or altered, which is absolutely devastating for web security! β‘ To mitigate this risk, ensure you're using the latest versions of Apache Tomcatβupgrade to at least version 9.0.0.M18, 8.5.12, 8.0.42, or 7.0.76 depending on your current version. Review your application's permissions and security configurations to limit access rights. π‘οΈ You've got this! With these updates, youβll help keep your server secure and protect your applications. π
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |
| apache/tomcat | all versions | β |