Skip to content
fr Sign in
Not rated

CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to…

Description

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Tomcat Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Tomcat

The 141 CVEs of Apache Tomcat →
CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body… Not rated CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous… Not rated CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with… Not rated CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently Not rated
Track this CVE