PT-2017-14152 · Apache+3 · Apache Tomcat+3

Published 2017-11-30 · Updated 2023-12-08 · CVE-2017-15706

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M22 through 9.0.1 Apache Tomcat versions 8.5.16 through 8.5.23 Apache Tomcat versions 8.0.45 through 8.0.47 Apache Tomcat versions 7.0.79 through 7.0.82

Description The issue concerns the documentation of the search algorithm used by the CGI Servlet in Apache Tomcat. An update to this documentation was incorrect, which may have caused some scripts to fail execution as expected, while others may have been executed unexpectedly. However, the actual behavior of the CGI servlet has not changed, only its documentation was incorrect and has been corrected.

Recommendations For Apache Tomcat versions 9.0.0.M22 through 9.0.1, update the documentation to reflect the correct search algorithm used by the CGI Servlet. For Apache Tomcat versions 8.5.16 through 8.5.23, update the documentation to reflect the correct search algorithm used by the CGI Servlet. For Apache Tomcat versions 8.0.45 through 8.0.47, update the documentation to reflect the correct search algorithm used by the CGI Servlet. For Apache Tomcat versions 7.0.79 through 7.0.82, update the documentation to reflect the correct search algorithm used by the CGI Servlet.

Exploit

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-1068

CWE-358

Related Identifiers

ALT-PU-2018-1731

CVE-2017-15706

GHSA-372Q-33VH-8MPC

MGASA-2018-0149

SUSE-SU-2018:0817-1

SUSE-SU-2018:3261-1

SUSE-SU-2018:3388-1

USN-3665-1

Affected Products

Alt Linux

Apache Tomcat

Suse

Ubuntu

References · 88

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb · Exploit
• 🔥 https://github.com/cyberheartmi9/CVE-2017-12617 · Exploit
• 🔥 https://github.com/Pa55w0rd/CVE-2018-1305 · Exploit
• 🔥 https://github.com/LongWayHomie/CVE-2017-12617 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2018-1304 · Exploit
• https://usn.ubuntu.com/3665-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1305 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12616 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3665-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15706 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0149.html · Security Note
• https://ubuntu.com/security/CVE-2017-12617 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15706 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0817-1 · Vendor Advisory