CVE-2017-7674

MEDIUM4.3EPSS 5.9%

Insufficient Verification of Data Authenticity in Apache Tomcat

發布日:2022/5/14修改日:2024/3/11
也稱為:GHSA-73rx-3f9r-x949

描述

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

參考連結(58)