CVE-2018-8014

41

FAUCET Score

CVE-2018-8014 describes an insecure default configuration in the Cross-Origin Resource Sharing (CORS) filter within Apache Tomcat versions 7.0.41 to 9.0.8, affecting products from vendors like Apache, Canonical, Debian, Microsoft, and NetApp. This critical vulnerability (CVSS 9.8) allows 'supportsCredentials' for all origins, potentially leading to high impact on confidentiality, integrity, and availability if not properly configured by the user. Despite its high severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 7.0.41, <= 7.0.88CPE matchmatch criteria	cpe:2.3:a:apache:tomcat::::::::
		>= 8.0.0, <= 8.0.52CPE matchmatch criteria	cpe:2.3:a:apache:tomcat::::::::
		>= 8.5.0, <= 8.5.31CPE matchmatch criteria	cpe:2.3:a:apache:tomcat::::::::
		>= 9.0.0, <= 9.0.8CPE matchmatch criteria	cpe:2.3:a:apache:tomcat::::::::
		8.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.0

Exploit Intelligence

EPSS Score

21.72%

Probability of exploitation in next 30 days

EPSS Percentile

97.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.2172 is in the 94th percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (36)

mavenpatch availablevia ghsa

Product: org.apache.tomcat.embed:tomcat-embed-coreFixed in: 8.5.32

mavenpatch availablevia ghsa

Product: org.apache.tomcat.embed:tomcat-embed-coreFixed in: 7.0.88

mavenpatch availablevia ghsa

Product: org.apache.tomcat.embed:tomcat-embed-coreFixed in: 9.0.9

mavenpatch availablevia ghsa

Product: org.apache.tomcat.embed:tomcat-embed-coreFixed in: 8.0.53

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: tomcat-0:7.0.76-9.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: pki-deps:10.6-8000020190524054914.55190bc5

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.2Fixed in: tomcat

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3.1Fixed in: tomcat7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3.1Fixed in: tomcat8

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: tomcat7-0:7.0.70-27.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: tomcat8-0:8.0.36-31.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 6Fixed in: tomcat-native-0:1.2.17-17.redhat_17.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: tomcat7-0:7.0.70-27.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: tomcat8-0:8.0.36-31.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 3 for RHEL 7Fixed in: tomcat-native-0:1.2.17-17.redhat_17.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0Fixed in: tomcat

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-ecj-0:4.6.1-6.redhat_1.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.10.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-jboss-logging-0:3.3.1-5.Final_redhat_1.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-mod_cluster-0:1.4.0-9.Final_redhat_1.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-tomcat-0:9.0.7-17.redhat_16.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-tomcat-native-0:1.2.17-26.redhat_26.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 6Fixed in: jws5-tomcat-vault-0:1.1.7-5.Final_redhat_2.1.el6jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-ecj-0:4.6.1-6.redhat_1.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.10.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-jboss-logging-0:3.3.1-5.Final_redhat_1.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-mod_cluster-0:1.4.0-9.Final_redhat_1.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-tomcat-0:9.0.7-17.redhat_16.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-tomcat-native-0:1.2.17-26.redhat_26.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.0 on RHEL 7Fixed in: jws5-tomcat-vault-0:1.1.7-5.Final_redhat_2.1.el7jws

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2Fixed in: tomcat7

redhatend of lifevia redhat_api

Product: Red Hat JBoss Fuse 6Fixed in: jbossweb

redhatend of lifevia redhat_api

Product: Red Hat JBoss Fuse Integration Service 2Fixed in: tomcat

redhatend of lifevia redhat_api

Product: Red Hat JBoss Fuse Service Works 6Fixed in: jbossweb

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Application RuntimesFixed in: tomcat

Vendor Advisories (2)

mavenGHSA-r4x2-3cq5-hqvpcritical

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

redhatCVE-2018-8014Moderate

tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

References

access.redhat.com / errata/RHSA-2018:2469

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2470

Third Party Advisory

access.redhat.com / errata/RHSA-2018:3768

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0450

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0451

Third Party Advisory

access.redhat.com / errata/RHSA-2019:1529

access.redhat.com / errata/RHSA-2019:2205

lists.apache.org / thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E

lists.apache.org / thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E

lists.apache.org / thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

lists.debian.org / debian-lts-announce/2018/06/msg00008.html

Third Party Advisory

lists.debian.org / debian-lts-announce/2019/08/msg00015.html

seclists.org / bugtraq/2019/Dec/43

security.netapp.com / advisory/ntap-20181018-0002

PatchThird Party Advisory

usn.ubuntu.com / 3665-1

Third Party Advisory

debian.org / security/2019/dsa-4596

oracle.com / security-alerts/cpuapr2020.html

tomcat.apache.org / security-7.html

Vendor Advisory

tomcat.apache.org / security-8.html

Vendor Advisory

tomcat.apache.org / security-9.html

Vendor Advisory

oracle.com / technetwork/security-advisory/cpuoct2018-4428296.html

PatchThird Party Advisory

securityfocus.com / bid/104203

Third Party AdvisoryVDB Entry

securitytracker.com / id/1040998

Third Party AdvisoryVDB Entry

securitytracker.com / id/1041888

Third Party AdvisoryVDB Entry