Published: 06/06/2017 Updated: 08/12/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 7.0.2
apache tomcat 7.0.49
apache tomcat 7.0.12
apache tomcat 7.0.62
apache tomcat 7.0.20
apache tomcat 7.0.34
apache tomcat 7.0.58
apache tomcat 7.0.8
apache tomcat 7.0.55
apache tomcat 7.0.1
apache tomcat 7.0.5
apache tomcat 7.0.51
apache tomcat 7.0.4
apache tomcat 7.0.63
apache tomcat 7.0.22
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.46
apache tomcat 7.0.72
apache tomcat 7.0.76
apache tomcat 7.0.71
apache tomcat 7.0.28
apache tomcat 7.0.59
apache tomcat 7.0.65
apache tomcat 7.0.0
apache tomcat 7.0.50
apache tomcat 7.0.6
apache tomcat 7.0.18
apache tomcat 7.0.14
apache tomcat 7.0.48
apache tomcat 7.0.11
apache tomcat 7.0.67
apache tomcat 7.0.74
apache tomcat 7.0.23
apache tomcat 7.0.66
apache tomcat 7.0.44
apache tomcat 7.0.69
apache tomcat 7.0.7
apache tomcat 7.0.42
apache tomcat 7.0.60
apache tomcat 7.0.37
apache tomcat 7.0.29
apache tomcat 7.0.45
apache tomcat 7.0.68
apache tomcat 7.0.13
apache tomcat 7.0.47
apache tomcat 7.0.41
apache tomcat 7.0.31
apache tomcat 7.0.30
apache tomcat 7.0.15
apache tomcat 7.0.19
apache tomcat 7.0.75
apache tomcat 7.0.16
apache tomcat 7.0.10
apache tomcat 7.0.36
apache tomcat 7.0.25
apache tomcat 7.0.54
apache tomcat 7.0.35
apache tomcat 7.0.61
apache tomcat 7.0.57
apache tomcat 7.0.43
apache tomcat 7.0.32
apache tomcat 7.0.38
apache tomcat 7.0.21
apache tomcat 7.0.27
apache tomcat 7.0.24
apache tomcat 7.0.17
apache tomcat 7.0.40
apache tomcat 7.0.9
apache tomcat 7.0.3
apache tomcat 7.0.77
apache tomcat 7.0.56
apache tomcat 7.0.64
apache tomcat 7.0.70
apache tomcat 7.0.33
apache tomcat 7.0.73
apache tomcat 8.0.4
apache tomcat 8.0.10
apache tomcat 8.0.30
apache tomcat 8.0.17
apache tomcat 8.0.7
apache tomcat 8.0.26
apache tomcat 8.0.40
apache tomcat 8.0.2
apache tomcat 8.0.20
apache tomcat 8.0.31
apache tomcat 8.0.5
apache tomcat 8.0.1
apache tomcat 8.0.0
apache tomcat 8.0.19
apache tomcat 8.0.39
apache tomcat 8.0.12
apache tomcat 8.0.27
apache tomcat 8.0.15
apache tomcat 8.0.22
apache tomcat 8.0.29
apache tomcat 8.0.42
apache tomcat 8.0.11
apache tomcat 8.0.24
apache tomcat 8.0.36
apache tomcat 8.0.23
apache tomcat 8.0.33
apache tomcat 8.0.6
apache tomcat 8.0.21
apache tomcat 8.0.32
apache tomcat 8.0.41
apache tomcat 8.0.25
apache tomcat 8.0.18
apache tomcat 8.0.35
apache tomcat 8.0.3
apache tomcat 8.0.38
apache tomcat 8.0.13
apache tomcat 8.0.14
apache tomcat 8.0.9
apache tomcat 8.0.43
apache tomcat 8.0.16
apache tomcat 8.0.34
apache tomcat 8.0.28
apache tomcat 8.0.37
apache tomcat 8.5.2
apache tomcat 8.5.9
apache tomcat 8.5.4
apache tomcat 8.5.0
apache tomcat 8.5.10
apache tomcat 8.5.13
apache tomcat 8.5.14
apache tomcat 8.5.5
apache tomcat 8.5.3
apache tomcat 8.5.6
apache tomcat 8.5.7
apache tomcat 8.5.8
apache tomcat 8.5.12
apache tomcat 8.5.11
apache tomcat 8.5.1
apache tomcat 9.0.0

Debian Bug report logs - #864447 tomcat8: CVE-2017-5664: Security constrained bypass in error page mechanism Package: src:tomcat8; Maintainer for src:tomcat8 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 8 Jun 2017 18:54:01 ...

Several security issues were fixed in Tomcat ...

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic An update for tomcat is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, w ...

Synopsis Important: Red Hat JBoss Web Server 310 Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31 for RHEL 6 and Red Hat JBoss Web Server 31 for RHEL 7Red Hat Product Security has rated this update as having a sec ...

Synopsis Important: tomcat6 security update Type/Severity Security Advisory: Important Topic An update for tomcat6 is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: Red Hat JBoss Web Server Service Pack 1 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method This could under certain conditions result in undesirable results, including the replacement or removal of the custom error page For the oldsta ...

Aniket Nandkishor Kulkarni discovered that in tomcat7, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method This could under certain conditions result in undesirable results, including the replacement or removal of the custom error page For the oldsta ...

A security issue has been found in Apache Tomcat < 7018 and < 8044 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page This means that the request is presented to the e ...

Security constrained bypass in error page mechanism:A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page (CVE-2017-5664) ...

Security constrained bypass in error page mechanism:While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 900M1 to 900M17, 850 to 8511, 800RC1 to 8041, and 700 to 7075 did not use the appropriate facade object When running an untrusted application under a SecurityManager, it was ...

Multiple vulnerabilities have been found in JP1/Network Node Manager i CVE-2016-6816, CVE-2017-5664 Affected products and versions are listed below Please upgrade your version to the appropriate version ...

Get Started

CVE-2017-5664

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect