CVE-2014-7810
En bref
- Source
- NVD
- EPSS
- EPSS 13.35 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
Références
- http://rhn.redhat.com/errata/RHSA-2016-0492.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
- http://www.ubuntu.com/usn/USN-2654-1
- http://rhn.redhat.com/errata/RHSA-2015-1622.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://svn.apache.org/viewvc?view=revision&revision=1644018
- http://www.debian.org/security/2016/dsa-3530
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc?view=revision&revision=1645642
- http://marc.info/?l=bugtraq&m=145974991225029&w=2
- http://rhn.redhat.com/errata/RHSA-2016-2046.html
- http://tomcat.apache.org/security-8.html
- http://www.debian.org/security/2015/dsa-3428
- http://tomcat.apache.org/security-6.html
- http://www.securityfocus.com/bid/74665
- http://www.securitytracker.com/id/1032330
- http://www.ubuntu.com/usn/USN-2655-1
- http://rhn.redhat.com/errata/RHSA-2015-1621.html
- http://www.debian.org/security/2016/dsa-3447
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-4c43-cwvx-9crh — Improper Access Control in Apache Tomcat
Références européennes
- ENISA EUVD · EUVD-2022-2350
- GCVE · GCVE-0-2014-7810
Avis du CERT-FR
- CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2019-AVI-186 — Multiples vulnérabilités dans IBM WebSphere · cert.ssi.gouv.fr
- CERTFR-2019-AVI-165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2019-AVI-138 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2015-AVI-441 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTFR-2015-AVI-317 — Multiples vulnérabilités dans les produits BlueCoat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*- +199 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |