Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Remediation

References

CVE-2017-7674

Related Vulnerabilities

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2080)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32477)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-6632)

Joomla Use of Insufficiently Random Values Vulnerability (CVE-2012-1562)

Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-3744)

Severity

Medium

Classification

CVE-2017-7674 CWE-345 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities