CVE-2013-4590: Infoleak
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or .tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Other sources
Application provided XML files such as web.xml, context.xml, .tld, .tagx and .jspx allowed XXE which could be used to expose Tomcat internals to an attacker. This vulnerability only occurs when Tomcat is running web applications from untrusted sources such as in a shared hosting environment.
This has been corrected in upstream versions 8.0.0-rc10 [1], 7.0.50 [2], and 6.0.39 [3]
[1] http://svn.apache.org/viewvc?view=revision&revision=1549528 [2] http://svn.apache.org/viewvc?view=revision&revision=1549529 [3] http://svn.apache.org/viewvc?view=revision&revision=1558828
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4590?
CVE-2013-4590 is classified as a medium severity vulnerability that allows for the exposure of sensitive internal information within Apache Tomcat.
How do I fix CVE-2013-4590?
To fix CVE-2013-4590, upgrade Apache Tomcat to version 6.0.39, 7.0.50 or later, or 8.0.0-RC10 or later.
Which versions of Apache Tomcat are affected by CVE-2013-4590?
CVE-2013-4590 affects Apache Tomcat versions 6.0.0 to 6.0.37, 7.0.0 to 7.0.49, and 8.0.0-RC1 to 8.0.0-RC9.
What types of attacks can exploit CVE-2013-4590?
CVE-2013-4590 can be exploited by attackers through untrusted web applications that utilize specific XML documents with external entity declarations.
What kind of information can be disclosed due to CVE-2013-4590?
CVE-2013-4590 can disclose sensitive internal information about the Apache Tomcat server configurations and internals.