Apache Tomcat Remote Code Execution Vulnerability. 悪用が確認されています：CISA は 25/03/2022 にこの脆弱性を「既知の悪用された脆弱性（KEV）」カタログに追加しました。影響を受けるシステムは緊急に修正してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 7.0.0, < 7.0.82≥ 8.0.0-RC1, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0.M1, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| org.apache.tomcat:tomcat-catalina | ≥ 7.0.0, < 7.0.82≥ 8.0.0-RC1, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0.M1, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| tomcat | ≥ 7.0.0, < 7.0.82≥ 8.0, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| active iq unified manager | ≥ 7.3≥ 9.5 | |
| agile product lifecycle management | = 9.3.3= 9.3.4= 9.3.5= 9.3.6 | |
| communications instant messaging server | = 10.0.1 | |
| endeca information discovery integrator | = 3.1.0= 3.2.0 | |
| enterprise manager for mysql database | = 12.1.0.4.0 | |
| financial services analytical applications infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.5.3.0≥ 8.0.0.0.0, ≤ 8.0.9.0.0 | |
| fmw platform | = 12.2.1.2.0= 12.2.1.3.0 | |
| health sciences empirica inspections | = 1.0.1.1 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | = 17.1= 17.2 | |
| management pack | = 11.2.1.0.13 | |
| micros lucas | = 2.9.5 | |
| micros retail xbri loss prevention | = 10.0.1= 10.5.0= 10.6.0= 10.7.0= 10.8.0= 10.8.1 | |
| mysql enterprise monitor | ≥ 3.4.0, ≤ 3.4.4.4226≥ 4.0.0, ≤ 4.0.0.5135≤ 3.3.6.3293 | |
| retail advanced inventory planning | = 13.2= 13.4= 14.1= 15.0 | |
| retail back office | = 14.0.4= 14.1.3 | |
| retail central office | = 14.0.4= 14.1.3 | |
| retail convenience and fuel pos software | = 2.1.132 | |
| retail eftlink | = 1.1.124= 15.0.1= 16.0.2 | |
| retail insights | = 14.0= 14.1= 15.0= 16.0 | |
| retail invoice matching | = 12.0= 13.0= 13.1= 13.2= 14.0= 14.1= 15.0= 16.0 | |
| retail order broker | = 15.0= 16.0= 5.0= 5.1= 5.2 | |
| retail order management system | = 4.0= 4.5= 4.7= 5.0 | |
| retail point-of-service | = 14.0.4= 14.1.3 | |
| retail price management | = 12.0= 13.0= 13.1= 13.2= 14.0= 14.1= 15.0= 16.0 | |
| retail returns management | = 14.0.4= 14.1.3= 2.3.8= 2.4.9 | |
| retail store inventory management | = 12.0.12= 13.0.7= 13.1.9= 13.2.9= 14.0.4= 14.1.3= 15.0.2= 16.0.1 | |
| retail xstore point of service | = 15.0.1= 6.0.11= 7.0.6= 7.1.6 | |
| transportation management | = 6.3.1= 6.3.2= 6.3.3= 6.3.4= 6.3.5= 6.3.6= 6.3.7 | |
| tuxedo system and applications monitor | = 12.1.3.0.0 | |
| webcenter sites | = 11.1.1.8.0 | |
| workload manager | = 12.2.0.1 | |
| fuse | = 1.0 | |
| jboss enterprise application platform | = 6.0.0= 6.4.0 | |
| jboss enterprise web server | = 2.0.0= 3.0.0 |
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン