GitStock

apache/tomcat · Security

Insufficient Verification of Data Authenticity in Apache Tomcat

GHSA ID
GHSA-73rx-3f9r-x949
CVE ID
CVE-2017-7674
Severity
medium
Published
Updated
CVSS
4.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v3
4.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

CWEs

  • CWE-345 · Insufficient Verification of Data Authenticity

References

Open GitHub