CVE-2013-4590: Exposure of Sensitive Information in Apache Tomcat
Summary
CVE-2013-4590: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
< 6.0.39
>= 7.0.0, < 7.0.50
>= 8.0.0-RC1, < 8.0.0-RC10
Fixed in 6.0.39, 7.0.50 or 8.0.0-RC10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, versions before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 are vulnerable to an information exposure issue.
Vulnerability Detail
The vulnerability, identified as CVE-2013-4590, allows attackers to obtain sensitive information about the internal workings of Apache Tomcat. This can be exploited by leveraging the presence of an untrusted web application with specific XML documents containing external entity declarations and entity references. This vulnerability is categorized as an XML External Entity (XXE) issue and can lead to unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.0.396.0.39 -
>= 7.0.0, < 7.0.507.0.50 -
>= 8.0.0-RC1, < 8.0.0-RC108.0.0-RC10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the processing of external entities in the affected XML documents. This can be achieved by modifying the Tomcat configuration to disallow the use of external entities. Here is an example of how to disable external entities in the context.xml file:
<Context> ... ``` <EntityExpansionLimit>0</EntityExpansionLimit> ``` ... ``` </Context> ```Conclusion
The vulnerability in Apache Tomcat (CVE-2013-4590) exposes sensitive information to unauthorized actors. To mitigate this issue, it is crucial to upgrade to the latest version of Apache Tomcat. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
CVE-2013-4590 is the identifier for the vulnerability that allows exposure of sensitive information in Apache Tomcat.
This vulnerability can be exploited by leveraging the presence of an untrusted web application with specific XML documents containing external entity declarations and entity references.
The vulnerability can lead to unauthorized access to sensitive information about the internal workings of Apache Tomcat, which can be exploited by attackers.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Tomcat that includes the necessary security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
