Apache Tomcat Security Bypass Vulnerability(CVE-2018-1305)

Vendor:

The Apache Software Foundation

Versions Affected:

Apache Tomcat 9.0.0.M1 to 9.0.4
Apache Tomcat 8.5.0 to 8.5.27
Apache Tomcat 8.0.0.RC1 to 8.0.49
Apache Tomcat 7.0.0 to 7.0.84

Description:

Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.

Mitigation:

Users of the affected versions should apply one of the following
mitigations. Upgrade to:

• Apache Tomcat 9.0.5 or later
• Apache Tomcat 8.5.28 or later
• Apache Tomcat 8.0.50 or later
• Apache Tomcat 7.0.85 or later