CVE-2013-4590
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- EPSS
- 9.5% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- debian:debian_linux
- oracle:solaris
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-87w9-x2c3-hrjj | Maven | org.apache.tomcat:tomcat | <6.0.39 | 6.0.39 |
| GHSA-87w9-x2c3-hrjj | Maven | org.apache.tomcat:tomcat | >=7.0.0 <7.0.50 | 7.0.50 |
| GHSA-87w9-x2c3-hrjj | Maven | org.apache.tomcat:tomcat | >=8.0.0-RC1 <8.0.0-RC10 | 8.0.0-RC10 |