Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Published

2014-02-26T14:55:08.207

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Application	apache	tomcat	8.0.0	Yes
Operating System	debian	debian_linux	7.0	Yes
Application	apache	tomcat	≤ 6.0.37	Yes
Application	apache	tomcat	1.1.3	Yes
Application	apache	tomcat	3.0	Yes
Application	apache	tomcat	3.1	Yes
Application	apache	tomcat	3.1.1	Yes
Application	apache	tomcat	3.2	Yes
Application	apache	tomcat	3.2.1	Yes
Application	apache	tomcat	3.2.2	Yes
Application	apache	tomcat	3.2.2	Yes
Application	apache	tomcat	3.2.3	Yes
Application	apache	tomcat	3.2.4	Yes
Application	apache	tomcat	3.3	Yes
Application	apache	tomcat	3.3.1	Yes
Application	apache	tomcat	3.3.1a	Yes
Application	apache	tomcat	3.3.2	Yes
Application	apache	tomcat	4	Yes
Application	apache	tomcat	4.0.0	Yes
Application	apache	tomcat	4.0.1	Yes
Application	apache	tomcat	4.0.2	Yes
Application	apache	tomcat	4.0.3	Yes
Application	apache	tomcat	4.0.4	Yes
Application	apache	tomcat	4.0.5	Yes
Application	apache	tomcat	4.0.6	Yes
Application	apache	tomcat	4.1.0	Yes
Application	apache	tomcat	4.1.1	Yes
Application	apache	tomcat	4.1.2	Yes
Application	apache	tomcat	4.1.3	Yes
Application	apache	tomcat	4.1.3	Yes
Application	apache	tomcat	4.1.9	Yes
Application	apache	tomcat	4.1.10	Yes
Application	apache	tomcat	4.1.12	Yes
Application	apache	tomcat	4.1.15	Yes
Application	apache	tomcat	4.1.24	Yes
Application	apache	tomcat	4.1.28	Yes
Application	apache	tomcat	4.1.29	Yes
Application	apache	tomcat	4.1.31	Yes
Application	apache	tomcat	4.1.36	Yes
Application	apache	tomcat	5	Yes
Application	apache	tomcat	5.0.0	Yes
Application	apache	tomcat	5.0.1	Yes
Application	apache	tomcat	5.0.2	Yes
Application	apache	tomcat	5.0.3	Yes
Application	apache	tomcat	5.0.4	Yes
Application	apache	tomcat	5.0.5	Yes
Application	apache	tomcat	5.0.6	Yes
Application	apache	tomcat	5.0.7	Yes
Application	apache	tomcat	5.0.8	Yes
Application	apache	tomcat	5.0.9	Yes
Application	apache	tomcat	5.0.10	Yes
Application	apache	tomcat	5.0.11	Yes
Application	apache	tomcat	5.0.12	Yes
Application	apache	tomcat	5.0.13	Yes
Application	apache	tomcat	5.0.14	Yes
Application	apache	tomcat	5.0.15	Yes
Application	apache	tomcat	5.0.16	Yes
Application	apache	tomcat	5.0.17	Yes
Application	apache	tomcat	5.0.18	Yes
Application	apache	tomcat	5.0.19	Yes
Application	apache	tomcat	5.0.21	Yes
Application	apache	tomcat	5.0.22	Yes
Application	apache	tomcat	5.0.23	Yes
Application	apache	tomcat	5.0.24	Yes
Application	apache	tomcat	5.0.25	Yes
Application	apache	tomcat	5.0.26	Yes
Application	apache	tomcat	5.0.27	Yes
Application	apache	tomcat	5.0.28	Yes
Application	apache	tomcat	5.0.29	Yes
Application	apache	tomcat	5.0.30	Yes
Application	apache	tomcat	5.5.0	Yes
Application	apache	tomcat	5.5.1	Yes
Application	apache	tomcat	5.5.2	Yes
Application	apache	tomcat	5.5.3	Yes
Application	apache	tomcat	5.5.4	Yes
Application	apache	tomcat	5.5.5	Yes
Application	apache	tomcat	5.5.6	Yes
Application	apache	tomcat	5.5.7	Yes
Application	apache	tomcat	5.5.8	Yes
Application	apache	tomcat	5.5.9	Yes
Application	apache	tomcat	5.5.10	Yes
Application	apache	tomcat	5.5.11	Yes
Application	apache	tomcat	5.5.12	Yes
Application	apache	tomcat	5.5.13	Yes
Application	apache	tomcat	5.5.14	Yes
Application	apache	tomcat	5.5.15	Yes
Application	apache	tomcat	5.5.16	Yes
Application	apache	tomcat	5.5.17	Yes
Application	apache	tomcat	5.5.18	Yes
Application	apache	tomcat	5.5.19	Yes
Application	apache	tomcat	5.5.20	Yes
Application	apache	tomcat	5.5.21	Yes
Application	apache	tomcat	5.5.22	Yes
Application	apache	tomcat	5.5.23	Yes
Application	apache	tomcat	5.5.24	Yes
Application	apache	tomcat	5.5.25	Yes
Application	apache	tomcat	5.5.26	Yes
Application	apache	tomcat	5.5.27	Yes
Application	apache	tomcat	5.5.28	Yes
Application	apache	tomcat	5.5.29	Yes
Application	apache	tomcat	5.5.30	Yes
Application	apache	tomcat	5.5.31	Yes
Application	apache	tomcat	5.5.32	Yes
Application	apache	tomcat	5.5.33	Yes
Application	apache	tomcat	5.5.34	Yes
Application	apache	tomcat	5.5.35	Yes
Application	apache	tomcat	6	Yes
Application	apache	tomcat	6.0	Yes
Application	apache	tomcat	6.0.0	Yes
Application	apache	tomcat	6.0.0	Yes
Application	apache	tomcat	6.0.1	Yes
Application	apache	tomcat	6.0.1	Yes
Application	apache	tomcat	6.0.2	Yes
Application	apache	tomcat	6.0.2	Yes
Application	apache	tomcat	6.0.2	Yes
Application	apache	tomcat	6.0.3	Yes
Application	apache	tomcat	6.0.10	Yes
Application	apache	tomcat	6.0.11	Yes
Application	apache	tomcat	6.0.12	Yes
Application	apache	tomcat	6.0.13	Yes
Application	apache	tomcat	6.0.14	Yes
Application	apache	tomcat	6.0.15	Yes
Application	apache	tomcat	6.0.16	Yes
Application	apache	tomcat	6.0.17	Yes
Application	apache	tomcat	6.0.18	Yes
Application	apache	tomcat	6.0.19	Yes
Application	apache	tomcat	6.0.20	Yes
Application	apache	tomcat	6.0.24	Yes
Application	apache	tomcat	6.0.26	Yes
Application	apache	tomcat	6.0.27	Yes
Application	apache	tomcat	6.0.28	Yes
Application	apache	tomcat	6.0.29	Yes
Application	apache	tomcat	6.0.30	Yes
Application	apache	tomcat	6.0.31	Yes
Application	apache	tomcat	6.0.32	Yes
Application	apache	tomcat	6.0.33	Yes
Application	apache	tomcat	6.0.35	Yes
Application	apache	tomcat	6.0.36	Yes
Application	apache	tomcat	7.0.0	Yes
Application	apache	tomcat	7.0.0	Yes
Application	apache	tomcat	7.0.1	Yes
Application	apache	tomcat	7.0.2	Yes
Application	apache	tomcat	7.0.2	Yes
Application	apache	tomcat	7.0.3	Yes
Application	apache	tomcat	7.0.4	Yes
Application	apache	tomcat	7.0.4	Yes
Application	apache	tomcat	7.0.10	Yes
Application	apache	tomcat	7.0.11	Yes
Application	apache	tomcat	7.0.12	Yes
Application	apache	tomcat	7.0.13	Yes
Application	apache	tomcat	7.0.14	Yes
Application	apache	tomcat	7.0.15	Yes
Application	apache	tomcat	7.0.16	Yes
Application	apache	tomcat	7.0.17	Yes
Application	apache	tomcat	7.0.18	Yes
Application	apache	tomcat	7.0.19	Yes
Application	apache	tomcat	7.0.20	Yes
Application	apache	tomcat	7.0.21	Yes
Application	apache	tomcat	7.0.22	Yes
Application	apache	tomcat	7.0.23	Yes
Application	apache	tomcat	7.0.24	Yes
Application	apache	tomcat	7.0.25	Yes
Application	apache	tomcat	7.0.26	Yes
Application	apache	tomcat	7.0.27	Yes
Application	apache	tomcat	7.0.28	Yes
Application	apache	tomcat	7.0.29	Yes
Application	apache	tomcat	7.0.30	Yes
Application	apache	tomcat	7.0.31	Yes
Application	apache	tomcat	7.0.32	Yes
Application	apache	tomcat	7.0.33	Yes
Application	apache	tomcat	7.0.34	Yes
Application	apache	tomcat	7.0.35	Yes
Application	apache	tomcat	7.0.36	Yes
Application	apache	tomcat	7.0.37	Yes
Application	apache	tomcat	7.0.38	Yes
Application	apache	tomcat	7.0.39	Yes
Application	apache	tomcat	7.0.40	Yes
Application	apache	tomcat	7.0.41	Yes
Application	apache	tomcat	7.0.42	Yes
Application	apache	tomcat	7.0.43	Yes
Application	apache	tomcat	7.0.44	Yes
Application	apache	tomcat	7.0.45	Yes
Application	apache	tomcat	7.0.46	Yes
Application	apache	tomcat	7.0.50	Yes
Operating System	oracle	solaris	11.2	Yes

References

http://advisories.mageia.org/MGASA-2014-0148.html Third Party Advisory ([email protected])
http://marc.info/?l=bugtraq&m=144498216801440&w=2 Mailing List ([email protected])
http://secunia.com/advisories/59036 Permissions Required, Third Party Advisory ([email protected])
http://secunia.com/advisories/59722 Permissions Required, Third Party Advisory ([email protected])
http://secunia.com/advisories/59724 Permissions Required, Third Party Advisory ([email protected])
http://secunia.com/advisories/59873 Permissions Required, Third Party Advisory ([email protected])
http://svn.apache.org/viewvc?view=revision&revision=1549528 Issue Tracking ([email protected])
http://svn.apache.org/viewvc?view=revision&revision=1549529 Issue Tracking ([email protected])
http://svn.apache.org/viewvc?view=revision&revision=1558828 Issue Tracking ([email protected])
http://tomcat.apache.org/security-6.html Vendor Advisory ([email protected])
http://tomcat.apache.org/security-7.html Vendor Advisory ([email protected])
http://tomcat.apache.org/security-8.html Vendor Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg21667883 Third Party Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg21675886 Third Party Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg21677147 Third Party Advisory ([email protected])
http://www-01.ibm.com/support/docview.wss?uid=swg21678231 Third Party Advisory ([email protected])
http://www.debian.org/security/2016/dsa-3530 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 Third Party Advisory ([email protected])
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory ([email protected])
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html ([email protected])
http://www.securityfocus.com/bid/65768 Third Party Advisory, VDB Entry ([email protected])
http://www.vmware.com/security/advisories/VMSA-2014-0008.html ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1069911 Issue Tracking ([email protected])
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 ([email protected])
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E ([email protected])
http://advisories.mageia.org/MGASA-2014-0148.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=144498216801440&w=2 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59036 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59722 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59724 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/59873 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://svn.apache.org/viewvc?view=revision&revision=1549528 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
http://svn.apache.org/viewvc?view=revision&revision=1549529 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
http://svn.apache.org/viewvc?view=revision&revision=1558828 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
http://tomcat.apache.org/security-6.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tomcat.apache.org/security-7.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tomcat.apache.org/security-8.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21667883 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21675886 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21677147 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www-01.ibm.com/support/docview.wss?uid=swg21678231 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2016/dsa-3530 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/65768 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.vmware.com/security/advisories/VMSA-2014-0008.html (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=1069911 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)