Back to CVE records
Medium 5.9Published Feb 28, 2018
CVE-2018-1304The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84…
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Tomcat and 10 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
- CVSS
- 5.9 MEDIUM (v3.0, NVD)CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Apache Software Foundation Apache Tomcat apache_software_foundation:apache_tomcat (from the name) | Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 | CNA record |
apache tomcat apache:tomcat | from 7.0.0 through 7.0.84; from 8.0.0 through 8.0.49; from 8.5.0 through 8.5.27; from 9.0.0 through 9.0.4; 8.0.0; 9.0.0; 9.0.0; 9.0.0; and 24 more ranges | NVD |
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform | 6; 6.4 | NVD |
redhat jboss_enterprise_web_server redhat:jboss_enterprise_web_server | 3.0.0 | NVD |
debian debian_linux debian:debian_linux | 7.0; 8.0; 9.0 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 14.04; 16.04; 17.10; 18.04 | NVD |
oracle fusion_middleware oracle:fusion_middleware | 12.2.1.3.0 | NVD |
oracle hospitality_guest_access oracle:hospitality_guest_access | 4.2.0; 4.2.1 | NVD |
oracle micros_relate_crm_software oracle:micros_relate_crm_software | 11.4 | NVD |
oracle secure_global_desktop oracle:secure_global_desktop | 5.3; 5.4 | NVD |
redhat jboss_middleware redhat:jboss_middleware | 1 | NVD |
References
- https://access.redhat.com/errata/RHSA-2018:1448vendor-advisory, x-refsource-redhat, third-party-advisory
- https://security.netapp.com/advisory/ntap-20180706-0001/x-refsource-confirm
- http://www.securityfocus.com/bid/103170vdb-entry, x-refsource-bid, third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlx-refsource-confirm, patch, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:1449vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:1450vendor-advisory, x-refsource-redhat, third-party-advisory
- https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3Ex-refsource-misc
- https://www.debian.org/security/2018/dsa-4281vendor-advisory, x-refsource-debian
- https://access.redhat.com/errata/RHSA-2018:2939vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:0465vendor-advisory, x-refsource-redhat, third-party-advisory
- https://usn.ubuntu.com/3665-1/vendor-advisory, x-refsource-ubuntu
- http://www.securitytracker.com/id/1040427vdb-entry, x-refsource-sectrack, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:1320vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:1451vendor-advisory, x-refsource-redhat, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00004.htmlmailing-list, x-refsource-mlist
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlx-refsource-confirm, patch, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00044.htmlmailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2018:0466vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2018:1447vendor-advisory, x-refsource-redhat, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.htmlmailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Emailing-list, x-refsource-mlist
- https://access.redhat.com/errata/RHSA-2019:2205
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.