| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-jasper | ≥ 6.0.0, < 6.0.47≥ 7.0.0, < 7.0.72≥ 8.0.0RC1, < 8.0.37≥ 8.5.0, < 8.5.5≥ 9.0.0.M1, < 9.0.0.M10 | 6.0.477.0.728.0.378.5.59.0.0.M10 |
| org.apache.tomcat:jasper | ≥ 6.0.0, < 6.0.47 | 6.0.47 |
| org.apache.tomcat:tomcat-jasper | ≥ 7.0.0, < 7.0.72≥ 8.0.0RC1, < 8.0.37≥ 8.5.0, < 8.5.5≥ 9.0.0.M1, < 9.0.0.M10 | 7.0.728.0.378.5.59.0.0.M10 |
| tomcat | = 9.0.0≥ 6.0.0, ≤ 6.0.45≥ 7.0.0, ≤ 7.0.70≥ 8.0, ≤ 8.0.36≥ 8.5.0, ≤ 8.5.4 | |
| tekelec platform distribution | ≥ 7.4.0, ≤ 7.7.1 | |
| jboss enterprise application platform | = 6.4 | |
| jboss enterprise web server | = 3.0.0 |
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free