EXPOSURES › CVE-2018-8014
CVE-2018-8014
CRITICAL
DETAIL
SourceNVD · cve
Published2018-05-16
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2018-8014 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
Microsoft · vendorNetApp · vendorapache · vendorcanonical · vendordebian · vendorTomcat · productdebian linux · productoncommand insight · productoncommand unified manager · productoncommand workflow automation · productsnapcenter server · productstorage automation store · productubuntu linux · productwindows · product
DESCRIPTION
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
SENTIMENT · TRUSTED SOURCES
synthesis
mixed
-0.20
Defaults insecure but expected user configuration; most unaffected.
Defaults insecure but expected user configuration; most unaffected.
"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most use"
No usable content; connection error.
AFFECTED FEDRAMP PRODUCTS · 5
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Cloud Insights NetApp |
In Process |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |