CVE-2018-1304

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-28 · updated 2026-10-15

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected products

Apache Tomcat: from 7.0.0 through 7.0.84; from 8.0.0 through 8.0.49; from 8.5.0 through 8.5.27; from 9.0.0 through 9.0.4; 8.0.0-rc1, 9.0.0-milestone1, 9.0.0-milestone10, 9.0.0-milestone11, 9.0.0-milestone12, 9.0.0-milestone13 (+22)
Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
Debian Linux: 7.0, 8.0, 9.0
Oracle Corporation Oracle Enterprise Manager for Fusion Middleware: 12.2.1.3.0
Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
Oracle Micros Relate Crm Software: 11.4
Oracle Corporation Secure Global Desktop: 5.3, 5.4
Red Hat JBoss EAP: 6, 6.4
Red Hat JBoss Enterprise Web Server: 3.0.0
RedHat Jboss Middleware: 1

References

Get alerted when CVE-2018-1304 or the next vulnerability affects your stack