KLA11472 ACE vulnerability in Apache Tomcat

Multiple vulnerabilities was found in Apache Tomcat. Malicious users can exploit this vulnerability to execute arbitrary code and perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. A vulnerability in CGI Servlet component can be exploited via due to a bug in the way the JRE passes command line arguments to execute arbitrary code;
2. A vulnerability in SSI printenv command can be exploited to perform cross-site scripting attack.

Original advisories

Apache Tomcat 8.x Security Vulnerabilities

Apache Tomcat 7.x Security Vulnerabilities

Apache Tomcat 9.x Security Vulnerabilities

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apache-Tomcat

CVE list

CVE-2019-0232 critical

CVE-2019-0221 high

Solution

Update to the latest versionDownload Tomcat 9

Download Tomcat 8

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Apache Tomcat 8.5.x earlier than 8.5.40Apache Tomcat 7.x earlier than 7.0.94Apache Tomcat 9.x earlier than 9.0.19