CVE-2018-8014
criticalThe defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and…
Vendor / product: Apache — tomcat
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS
9.8
9.8 (CVSS v3.0)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.0 (nvd@nist.gov)
Timeline (UTC)
Published: 2018-05-16 16:29
Modified: 2026-10-15 18:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
apache / tomcat ≥7.0.41 ≤7.0.88, ≥8.0.0 ≤8.0.52, ≥8.5.0 ≤8.5.31, ≥9.0.0 ≤9.0.8, 8.0.0, 9.0.0
canonical / ubuntu_linux 14.04, 16.04, 17.10, 18.04
debian / debian_linux 8.0
netapp / oncommand_insight all versions
netapp / oncommand_unified_manager ≥9.4, ≥7.3
netapp / oncommand_workflow_automation all versions
netapp / snapcenter_server all versions
netapp / storage_automation_store all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: http://tomcat.apache.org/security-7.html
Vendor advisory: http://tomcat.apache.org/security-8.html
Vendor advisory: http://tomcat.apache.org/security-9.html
Vendor advisory: http://tomcat.apache.org/security-7.html
Vendor advisory: http://tomcat.apache.org/security-8.html
Vendor advisory: http://tomcat.apache.org/security-9.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch / mitigation: https://security.netapp.com/advisory/ntap-20181018-0002/
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch / mitigation: https://security.netapp.com/advisory/ntap-20181018-0002/
References
- http://tomcat.apache.org/security-7.html security@apache.org
- http://tomcat.apache.org/security-8.html security@apache.org
- http://tomcat.apache.org/security-9.html security@apache.org
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html security@apache.org
- http://www.securityfocus.com/bid/104203 security@apache.org
- http://www.securitytracker.com/id/1040998 security@apache.org
- http://www.securitytracker.com/id/1041888 security@apache.org
- https://access.redhat.com/errata/RHSA-2018:2469 security@apache.org
- https://access.redhat.com/errata/RHSA-2018:2470 security@apache.org
- https://access.redhat.com/errata/RHSA-2018:3768 security@apache.org
- https://access.redhat.com/errata/RHSA-2019:0450 security@apache.org
- https://access.redhat.com/errata/RHSA-2019:0451 security@apache.org
- https://access.redhat.com/errata/RHSA-2019:1529 security@apache.org
- https://access.redhat.com/errata/RHSA-2019:2205 security@apache.org
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e... security@apache.org
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0... security@apache.org
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f... security@apache.org
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f98831508693... security@apache.org
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644... security@apache.org
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb6... security@apache.org
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77... security@apache.org
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a... security@apache.org
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22... security@apache.org
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bb... security@apache.org
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793... security@apache.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗