CVE-2018-1304 — Apache Tomcat unauthorized access vulnerability

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 9	tomcat8	8.5.14-1+deb9u3	DSA-4281-1
Debian 8	tomcat7	7.0.56-3+really7.0.88-1	DLA-1400-1
Debian 8	tomcat8	8.0.14-1+deb8u12	DLA-1450-1
Debian 7	tomcat7	7.0.28-4+deb7u18	DLA-1301-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	tomcat8	8.5.30-1ubuntu1.2	USN-3665-1
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.6	USN-3665-1
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.14	USN-3665-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	tomcat7	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-9.el7	RHSA-2019:2205

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	mod_cluster +2	1.3.8-2.Final_redhat_2.1.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat-native	1.2.8-11.redhat_11.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat-vault +2	1.1.6-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-25.ep7.el6	RHSA-2018:0466
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-29.ep7.el6	RHSA-2018:0466
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-12.redhat_6.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	hornetq	2.3.25-26.SP24_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jboss-as-ee +62	7.5.20-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jboss-ec2-eap +1	7.5.20-1.Final_redhat_1.ep6.el6	RHSA-2018:1451
Red Hat JBoss EAP 6	jbossts	1:4.17.43-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jbossweb	7.5.28-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jgroups	1:3.2.18-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	lucene-solr	3.6.2-8.redhat_9.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	picketbox	4.1.7-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP3	tomcat	8.0.50-29.8.2	SUSE-SU-2018:0817-1
SLES 12 SP2	tomcat	8.0.50-29.8.2	SUSE-SU-2018:0817-1
SLES 12 SP1	tomcat	8.0.53-10.35.1	SUSE-SU-2018:3388-1
SLES 12	tomcat	7.0.90-7.23.1	SUSE-SU-2018:3261-1
SLES 11 SP4	tomcat6	6.0.53-0.57.7.1	SUSE-SU-2018:1847-1

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP3	tomcat	8.0.50-29.8.2	SUSE-SU-2018:0817-1
SLES for SAP 12 SP2	tomcat	8.0.50-29.8.2	SUSE-SU-2018:0817-1
SLES for SAP 12 SP1	tomcat	8.0.53-10.35.1	SUSE-SU-2018:3388-1
SLES for SAP 11 SP4	tomcat6	6.0.53-0.57.7.1	SUSE-SU-2018:1847-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	tomcat +9	7.0.76-10.amzn2.0.1	ALAS2-2020-1402

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-9.el7	ELSA-2019-2205

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

knqyf263/CVE-2018-1304 ★ 3 · Feb 24, 2018
thariyarox/tomcat_CVE-2018-1304_testing ★ 0 · Mar 8, 2018

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.0, < 9.0.5	9.0.5	GHSA-6rxj-58jh-436r
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.5.0, < 8.5.28	8.5.28	GHSA-6rxj-58jh-436r
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.0.0, < 8.0.51	8.0.51	GHSA-6rxj-58jh-436r
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 7.0.0, < 7.0.86	7.0.86	GHSA-6rxj-58jh-436r

Advisories 19

RHSA-2018:0466 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
RHSA-2018:1451 Red Hat Security Advisory: eap6-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1448 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2019:2205 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-3665-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4281-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1450-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1400-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-1301-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2018:3261-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:3388-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:1847-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2018:0817-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
ALAS2-2020-1402 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 28, 2021
ELSA-2019-2205 Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019

References

RHSA-2018:1448 vendor-advisory
https://security.netapp.com/advisory/ntap-20180706-0001/
103170 vdb-entry
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
RHSA-2018:1449 vendor-advisory
RHSA-2018:1450 vendor-advisory
https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E
DSA-4281 vendor-advisory
RHSA-2018:2939 vendor-advisory
RHSA-2018:0465 vendor-advisory
USN-3665-1 vendor-advisory
1040427 vdb-entry
RHSA-2018:1320 vendor-advisory
RHSA-2018:1451 vendor-advisory
[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update mailing-list
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update mailing-list
RHSA-2018:0466 vendor-advisory
RHSA-2018:1447 vendor-advisory
[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
RHSA-2019:2205 vendor-advisory
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html