CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

CVSS 3.0

9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

21% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-1188

Published

2018-05-16

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• apache:tomcat
• canonical:ubuntu_linux
• debian:debian_linux
• netapp:oncommand_insight
• netapp:oncommand_unified_manager
• netapp:oncommand_workflow_automation
• netapp:snapcenter_server
• netapp:storage_automation_store

Packages (OSV)

References

• http://tomcat.apache.org/security-7.html
• http://tomcat.apache.org/security-8.html
• http://tomcat.apache.org/security-9.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/104203

Check your stackJSON