Medium severity · published Aug 11, 2017
CVE-2017-7674
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response…
4.3
CVSS
8%
EPSS
No
On KEV
Description
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.0% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
9.0.0.M1 to 9.0.0.M21; 8.5.0 to 8.5.15; 8.0.0.RC1 to 8.0.44; 7.0.41 to 7.0.78 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7674
www.debian.org
http://www.debian.org/security/2017/dsa-3974
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Third Party Advisory
http://www.securityfocus.com/bid/100280
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:1801
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:1802
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:3081
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g