Apache Tomcat Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 7.0.0, < 7.0.82≥ 8.0.0-RC1, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0.M1, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| org.apache.tomcat:tomcat-catalina | ≥ 7.0.0, < 7.0.82≥ 8.0.0-RC1, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0.M1, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| tomcat | ≥ 7.0.0, < 7.0.82≥ 8.0, < 8.0.47≥ 8.5.0, < 8.5.23≥ 9.0.0, < 9.0.1 | 7.0.828.0.478.5.239.0.1 |
| active iq unified manager | ≥ 7.3≥ 9.5 | |
| agile product lifecycle management | = 9.3.3= 9.3.4= 9.3.5= 9.3.6 | |
| communications instant messaging server | = 10.0.1 | |
| endeca information discovery integrator | = 3.1.0= 3.2.0 | |
| enterprise manager for mysql database | = 12.1.0.4.0 | |
| financial services analytical applications infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.5.3.0≥ 8.0.0.0.0, ≤ 8.0.9.0.0 | |
| fmw platform | = 12.2.1.2.0= 12.2.1.3.0 | |
| health sciences empirica inspections | = 1.0.1.1 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | = 17.1= 17.2 | |
| management pack | = 11.2.1.0.13 | |
| micros lucas | = 2.9.5 | |
| micros retail xbri loss prevention | = 10.0.1= 10.5.0= 10.6.0= 10.7.0= 10.8.0= 10.8.1 | |
| mysql enterprise monitor | ≥ 3.4.0, ≤ 3.4.4.4226≥ 4.0.0, ≤ 4.0.0.5135≤ 3.3.6.3293 | |
| retail advanced inventory planning | = 13.2= 13.4= 14.1= 15.0 | |
| retail back office | = 14.0.4= 14.1.3 | |
| retail central office | = 14.0.4= 14.1.3 | |
| retail convenience and fuel pos software | = 2.1.132 | |
| retail eftlink | = 1.1.124= 15.0.1= 16.0.2 | |
| retail insights | = 14.0= 14.1= 15.0= 16.0 | |
| retail invoice matching | = 12.0= 13.0= 13.1= 13.2= 14.0= 14.1= 15.0= 16.0 | |
| retail order broker | = 15.0= 16.0= 5.0= 5.1= 5.2 | |
| retail order management system | = 4.0= 4.5= 4.7= 5.0 | |
| retail point-of-service | = 14.0.4= 14.1.3 | |
| retail price management | = 12.0= 13.0= 13.1= 13.2= 14.0= 14.1= 15.0= 16.0 | |
| retail returns management | = 14.0.4= 14.1.3= 2.3.8= 2.4.9 | |
| retail store inventory management | = 12.0.12= 13.0.7= 13.1.9= 13.2.9= 14.0.4= 14.1.3= 15.0.2= 16.0.1 | |
| retail xstore point of service | = 15.0.1= 6.0.11= 7.0.6= 7.1.6 | |
| transportation management | = 6.3.1= 6.3.2= 6.3.3= 6.3.4= 6.3.5= 6.3.6= 6.3.7 | |
| tuxedo system and applications monitor | = 12.1.3.0.0 | |
| webcenter sites | = 11.1.1.8.0 | |
| workload manager | = 12.2.0.1 | |
| fuse | = 1.0 | |
| jboss enterprise application platform | = 6.0.0= 6.4.0 | |
| jboss enterprise web server | = 2.0.0= 3.0.0 |
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free