{"id":"CVE-2017-5648","published":"2017-04-17T16:00:00Z","modified":"2026-10-15T15:56:30Z","title":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to…","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.13225,"percentile":0.96362,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.gentoo.org/glsa/201705-09","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/97530","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2017/dsa-3843","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id/1038220","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.debian.org/security/2017/dsa-3842","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/20/8","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.3,"factors":[{"name":"EPSS percentile","points":19.27}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["9.0.0.M1 to 9.0.0.M17","8.5.0 to 8.5.11","8.0.0.RC1 to 8.0.41","7.0.0 to 7.0.75"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M18",">=8.5.0, <8.5.13",">=8.0.0, <8.0.42",">=7.0.0, <7.0.76"],"patched":["9.0.0.M18","8.5.13","8.0.42","7.0.76"],"from":["GHSA-3vx3-xf6q-r5xp"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M18",">=8.5.0, <8.5.13",">=8.0.0, <8.0.42",">=7.0.0, <7.0.76"],"patched":["9.0.0.M18","8.5.13","8.0.42","7.0.76"],"from":["GHSA-3vx3-xf6q-r5xp"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2247","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-12616","published":"2017-09-19","fixed":"7.0.81","kev":false,"link":{"from":"CVE-2017-5648","to":"CVE-2017-12616","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.76","toFixed":"7.0.81","daysApart":155}]}},{"cve":"CVE-2014-0119","published":"2014-05-31","fixed":"8.0.6","kev":false},{"cve":"CVE-2016-5388","published":"2016-07-19","fixed":"8.5.5","kev":false},{"cve":"CVE-2016-8735","published":"2017-04-06","fixed":"9.0.0.M12","kev":true,"link":{"from":"CVE-2016-8735","to":"CVE-2017-5648","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.0.M12","toFixed":"9.0.0.M18","daysApart":11},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.73","toFixed":"7.0.76","daysApart":11}]}},{"cve":"CVE-2017-5648","published":"2017-04-17","fixed":"9.0.0.M18","kev":false},{"cve":"CVE-2017-12617","published":"2017-10-04","fixed":"9.0.1","kev":true,"link":{"from":"CVE-2017-5648","to":"CVE-2017-12617","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.0.42","toFixed":"8.0.47","daysApart":170},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.0.M18","toFixed":"9.0.1","daysApart":170}]}},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false},{"cve":"CVE-2020-9484","published":"2020-05-20","fixed":"10.0.0-M5","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-catalina"}}