Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Remediation

References

CVE-2017-7674

Related Vulnerabilities

WordPress Plugin A to Z Category Listing 'R' Parameter SQL Injection (1.3)

Oracle JRE CVE-2022-21294 Vulnerability (CVE-2022-21294)

WordPress Plugin Bold Page Builder Security Bypass (2.3.1)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43734)

Mailman Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12137)

Severity

Medium

Classification

CVE-2017-7674 CWE-345 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities