CVE-2018-1304
- State
- Published
- Severity
- Not scored
- Published
- Feb 28, 2018
- Updated
- Oct 15, 2026
- Reserved
- Dec 7, 2017
Description
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache TomcatApache Software Foundation |
|
References
- RHSA-2018:1448vendor-advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/
- 103170vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- RHSA-2018:1449vendor-advisory
- RHSA-2018:1450vendor-advisory
- https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E
- DSA-4281vendor-advisory
- RHSA-2018:2939vendor-advisory
- RHSA-2018:0465vendor-advisory
- USN-3665-1vendor-advisory
- 1040427vdb-entry
- RHSA-2018:1320vendor-advisory
- RHSA-2018:1451vendor-advisory
- [debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security updatemailing-list
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- [debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security updatemailing-list
- RHSA-2018:0466vendor-advisory
- RHSA-2018:1447vendor-advisory
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security updatemailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- RHSA-2019:2205vendor-advisory
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.