org.apache.tomcat:tomcat@10.0.0-M4 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Form authentication example in the examples web application displayed user provided data without filtering, exposing a potential XSS vulnerability.

Note: This is a vulnerability in webapps/examples/jsp/security/protected/index.jsp file which is not used in any of the core Tomcat artifacts, and which therefore only affects users who did not remove the examples of web application as documented in the Tomcat security guide.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.tomcat:tomcat to version 8.5.82, 9.0.65, 10.0.23, 10.1.0-M17 or higher.

[8.5.50,8.5.82) [9.0.30,9.0.65) [10.0.0-M1,10.0.23) [10.1.0-M1,10.1.0-M17)
  • M
Improper Input Validation

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Improper Input Validation. Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (e.g., user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

How to fix Improper Input Validation?

Upgrade org.apache.tomcat:tomcat to version 10.0.6, 9.0.46, 8.5.66, 7.0.109 or higher.

[10.0.0-M1,10.0.6) [9.0.0.M1,9.0.46) [8.5.0,8.5.66) [7.0.0,7.0.109)
  • M
HTTP Request Smuggling

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to HTTP Request Smuggling. Tomcat does not correctly parse the HTTP transfer-encoding request header in some circumstances, leading to the possibility of request smuggling when used with a reverse proxy.

Specifically, Tomcat incorrectly ignores the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; it honours the identify encoding; and it does not ensure that, if present, the chunked encoding was the final encoding.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat:tomcat to version 10.0.7, 9.0.48, 8.5.68 or higher.

[10.0.0-M1,10.0.7) [9.0.0.M1,9.0.48) [8.5.0,8.5.68)