CVE-2014-0096: Improper Input Validation in Apache Tomcat
Summary
CVE-2014-0096: Improper Input Validation in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
< 6.0.40
>= 7.0.0, < 7.0.54
>= 8.0.0, < 8.0.6
Fixed in 6.0.40, 7.0.54 or 8.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. Apache Tomcat versions before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability exists in the default servlet of Apache Tomcat. The servlet does not properly restrict XSLT stylesheets, allowing remote attackers to bypass security-manager restrictions and read arbitrary files. This can be exploited by a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, resulting in an XML External Entity (XXE) issue. An attacker can exploit this vulnerability to gain unauthorized access to sensitive files on the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.0.406.0.40 -
>= 7.0.0, < 7.0.547.0.54 -
>= 8.0.0, < 8.0.68.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Tomcat to mitigate the risk.
Conclusion
The vulnerability in Apache Tomcat allows remote attackers to bypass security restrictions and read arbitrary files on the server. To mitigate the risk, it is recommended to upgrade to the latest version of Apache Tomcat. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
Versions before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 are affected by this vulnerability.
This vulnerability allows remote attackers to read arbitrary files on the server, bypassing security-manager restrictions.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Tomcat.
To fix this vulnerability, upgrade Apache Tomcat to version 6.0.40 or later for 6.x series, 7.0.54 or later for 7.x series, and 8.0.6 or later for 8.x series.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
