CVE-2018-1305: Apache Tomcat Security Bypass Vulnerability

CVE-2018-1305 Security constraint annotations applied too late

Severity: High

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.4
Apache Tomcat 8.5.0 to 8.5.27
Apache Tomcat 8.0.0.RC1 to 8.0.49
Apache Tomcat 7.0.0 to 7.0.84

Description:
Security constraints defined by annotations of Servlets were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible – depending on the order Servlets were loaded for some security constraints not to be applied. This could have exposed resources to users who were not authorized to access them.

Mitigation:
Users of the affected versions should apply one of the following mitigations. Upgrade to:
– Apache Tomcat 9.0.5 or later
– Apache Tomcat 8.5.28 or later
– Apache Tomcat 8.0.50 or later
– Apache Tomcat 7.0.85 or later

Source: Apache