CVE-2013-4590

Apache Tomcat <6.0.39, 7.x <7.0.50, 8.x <8.0.0-RC10 - Info Disclosure

Title source: llm

Description

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References (31)

Core 31

Core References

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0008.html

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html

Third Party Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2015:052

Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59724

Third Party Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2015:084

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3530

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-7.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-8.html

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21677147

Issue Tracking x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1549528

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21678231

Third Party Advisory x_refsource_confirm

http://advisories.mageia.org/MGASA-2014-0148.html

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1069911

Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59722

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/65768

Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-6.html

Various Sources x_refsource_confirm

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013

Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59873

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21667883

Issue Tracking x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1558828

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=144498216801440&w=2

Third Party Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21675886

Issue Tracking x_refsource_confirm

http://svn.apache.org/viewvc?view=revision&revision=1549529

Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59036

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.0092

EPSS Percentile 76.3%

Details

CWE

CWE-200

Status published

Products (40)

apache/tomcat 8.0.0 rc1 (9 CPE variants)

apache/tomcat 1.1.3

apache/tomcat 3.0

apache/tomcat 3.1

apache/tomcat 3.1.1

apache/tomcat 3.2

apache/tomcat 3.2.1

apache/tomcat 3.2.2 (2 CPE variants)

apache/tomcat 3.2.3

apache/tomcat 3.2.4

... and 30 more

Published Feb 26, 2014

Tracked Since Feb 18, 2026