Lucene search

K
nvd[email protected]NVD:CVE-2017-5664
HistoryJun 06, 2017 - 2:29 p.m.

CVE-2017-5664

2017-06-0614:29:00
CWE-755
web.nvd.nist.gov
12

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.5

Confidence

High

EPSS

0.009

Percentile

82.7%

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Affected configurations

Nvd
Node
apachetomcatMatch7.0.0
OR
apachetomcatMatch7.0.0beta
OR
apachetomcatMatch7.0.1
OR
apachetomcatMatch7.0.2
OR
apachetomcatMatch7.0.2beta
OR
apachetomcatMatch7.0.3
OR
apachetomcatMatch7.0.4
OR
apachetomcatMatch7.0.4beta
OR
apachetomcatMatch7.0.5
OR
apachetomcatMatch7.0.5beta
OR
apachetomcatMatch7.0.6
OR
apachetomcatMatch7.0.7
OR
apachetomcatMatch7.0.8
OR
apachetomcatMatch7.0.9
OR
apachetomcatMatch7.0.10
OR
apachetomcatMatch7.0.11
OR
apachetomcatMatch7.0.12
OR
apachetomcatMatch7.0.13
OR
apachetomcatMatch7.0.14
OR
apachetomcatMatch7.0.15
OR
apachetomcatMatch7.0.16
OR
apachetomcatMatch7.0.17
OR
apachetomcatMatch7.0.18
OR
apachetomcatMatch7.0.19
OR
apachetomcatMatch7.0.20
OR
apachetomcatMatch7.0.21
OR
apachetomcatMatch7.0.22
OR
apachetomcatMatch7.0.23
OR
apachetomcatMatch7.0.24
OR
apachetomcatMatch7.0.25
OR
apachetomcatMatch7.0.26
OR
apachetomcatMatch7.0.27
OR
apachetomcatMatch7.0.28
OR
apachetomcatMatch7.0.29
OR
apachetomcatMatch7.0.30
OR
apachetomcatMatch7.0.31
OR
apachetomcatMatch7.0.32
OR
apachetomcatMatch7.0.33
OR
apachetomcatMatch7.0.34
OR
apachetomcatMatch7.0.35
OR
apachetomcatMatch7.0.36
OR
apachetomcatMatch7.0.37
OR
apachetomcatMatch7.0.38
OR
apachetomcatMatch7.0.39
OR
apachetomcatMatch7.0.40
OR
apachetomcatMatch7.0.41
OR
apachetomcatMatch7.0.42
OR
apachetomcatMatch7.0.43
OR
apachetomcatMatch7.0.44
OR
apachetomcatMatch7.0.45
OR
apachetomcatMatch7.0.46
OR
apachetomcatMatch7.0.47
OR
apachetomcatMatch7.0.48
OR
apachetomcatMatch7.0.49
OR
apachetomcatMatch7.0.50
OR
apachetomcatMatch7.0.51
OR
apachetomcatMatch7.0.54
OR
apachetomcatMatch7.0.55
OR
apachetomcatMatch7.0.56
OR
apachetomcatMatch7.0.57
OR
apachetomcatMatch7.0.58
OR
apachetomcatMatch7.0.59
OR
apachetomcatMatch7.0.60
OR
apachetomcatMatch7.0.61
OR
apachetomcatMatch7.0.62
OR
apachetomcatMatch7.0.63
OR
apachetomcatMatch7.0.64
OR
apachetomcatMatch7.0.65
OR
apachetomcatMatch7.0.66
OR
apachetomcatMatch7.0.67
OR
apachetomcatMatch7.0.68
OR
apachetomcatMatch7.0.69
OR
apachetomcatMatch7.0.70
OR
apachetomcatMatch7.0.71
OR
apachetomcatMatch7.0.72
OR
apachetomcatMatch7.0.73
OR
apachetomcatMatch7.0.74
OR
apachetomcatMatch7.0.75
OR
apachetomcatMatch7.0.76
OR
apachetomcatMatch7.0.77
Node
apachetomcatMatch8.0.0rc1
OR
apachetomcatMatch8.0.0rc10
OR
apachetomcatMatch8.0.0rc3
OR
apachetomcatMatch8.0.0rc5
OR
apachetomcatMatch8.0.1
OR
apachetomcatMatch8.0.2
OR
apachetomcatMatch8.0.3
OR
apachetomcatMatch8.0.4
OR
apachetomcatMatch8.0.5
OR
apachetomcatMatch8.0.6
OR
apachetomcatMatch8.0.7
OR
apachetomcatMatch8.0.9
OR
apachetomcatMatch8.0.10
OR
apachetomcatMatch8.0.11
OR
apachetomcatMatch8.0.12
OR
apachetomcatMatch8.0.13
OR
apachetomcatMatch8.0.14
OR
apachetomcatMatch8.0.15
OR
apachetomcatMatch8.0.16
OR
apachetomcatMatch8.0.17
OR
apachetomcatMatch8.0.18
OR
apachetomcatMatch8.0.19
OR
apachetomcatMatch8.0.20
OR
apachetomcatMatch8.0.21
OR
apachetomcatMatch8.0.22
OR
apachetomcatMatch8.0.23
OR
apachetomcatMatch8.0.24
OR
apachetomcatMatch8.0.25
OR
apachetomcatMatch8.0.26
OR
apachetomcatMatch8.0.27
OR
apachetomcatMatch8.0.28
OR
apachetomcatMatch8.0.29
OR
apachetomcatMatch8.0.30
OR
apachetomcatMatch8.0.31
OR
apachetomcatMatch8.0.32
OR
apachetomcatMatch8.0.33
OR
apachetomcatMatch8.0.34
OR
apachetomcatMatch8.0.35
OR
apachetomcatMatch8.0.36
OR
apachetomcatMatch8.0.37
OR
apachetomcatMatch8.0.38
OR
apachetomcatMatch8.0.39
OR
apachetomcatMatch8.0.40
OR
apachetomcatMatch8.0.41
OR
apachetomcatMatch8.0.42
OR
apachetomcatMatch8.0.43
Node
apachetomcatMatch8.5.0
OR
apachetomcatMatch8.5.1
OR
apachetomcatMatch8.5.2
OR
apachetomcatMatch8.5.3
OR
apachetomcatMatch8.5.4
OR
apachetomcatMatch8.5.5
OR
apachetomcatMatch8.5.6
OR
apachetomcatMatch8.5.7
OR
apachetomcatMatch8.5.8
OR
apachetomcatMatch8.5.9
OR
apachetomcatMatch8.5.10
OR
apachetomcatMatch8.5.11
OR
apachetomcatMatch8.5.12
OR
apachetomcatMatch8.5.13
OR
apachetomcatMatch8.5.14
Node
apachetomcatMatch9.0.0milestone1
OR
apachetomcatMatch9.0.0milestone10
OR
apachetomcatMatch9.0.0milestone11
OR
apachetomcatMatch9.0.0milestone12
OR
apachetomcatMatch9.0.0milestone13
OR
apachetomcatMatch9.0.0milestone14
OR
apachetomcatMatch9.0.0milestone15
OR
apachetomcatMatch9.0.0milestone16
OR
apachetomcatMatch9.0.0milestone17
OR
apachetomcatMatch9.0.0milestone18
OR
apachetomcatMatch9.0.0milestone19
OR
apachetomcatMatch9.0.0milestone2
OR
apachetomcatMatch9.0.0milestone20
OR
apachetomcatMatch9.0.0milestone3
OR
apachetomcatMatch9.0.0milestone4
OR
apachetomcatMatch9.0.0milestone5
OR
apachetomcatMatch9.0.0milestone6
OR
apachetomcatMatch9.0.0milestone7
OR
apachetomcatMatch9.0.0milestone8
OR
apachetomcatMatch9.0.0milestone9
VendorProductVersionCPE
apachetomcat7.0.0cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
apachetomcat7.0.0cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
apachetomcat7.0.1cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
apachetomcat7.0.2cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
apachetomcat7.0.2cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*
apachetomcat7.0.3cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
apachetomcat7.0.4cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
apachetomcat7.0.4cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*
apachetomcat7.0.5cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
apachetomcat7.0.5cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*
Rows per page:
1-10 of 1611

References

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.5

Confidence

High

EPSS

0.009

Percentile

82.7%