{"cve":"CVE-2018-1305","nvd":{"published":"2018-02-23T23:29:00.937","modified":"2026-10-15T18:17:19.253","status":"Modified","description":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":[],"references":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103144","http://www.securitytracker.com/id/1040428","https://access.redhat.com/errata/RHSA-2018:0465"],"products":["apache:tomcat","canonical:ubuntu_linux","debian:debian_linux","oracle:fusion_middleware","oracle:managed_file_transfer","oracle:micros_relate_crm_software"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2018-1305","score":0.14472,"percentile":0.96606,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-jx6h-3fjx-cgv5","url":"https://osv.dev/vulnerability/GHSA-jx6h-3fjx-cgv5","summary":"Apache Tomcat information exposure vulnerability","modified":"2024-11-29T05:50:11.687725Z","packages":[{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=9.0.0M1 <9.0.5"],"fixed":["9.0.5"]},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=8.5.0 <8.5.28"],"fixed":["8.5.28"]},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=7.0.0 <7.0.85"],"fixed":["7.0.85"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}