CVE-2013-4590
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
4.3 MediumFix available
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
9.49%Up 4.2 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4590- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4590- Updated
- 2026-11-02
EUVDEUVD-2022-3142 No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-3142- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-87w9-x2c3-hrjj No score
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-87w9-x2c3-hrjj- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-87w9-x2c3-hrjj No score
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-87w9-x2c3-hrjj- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2014-0148 No score
Updated tomcat package fixes security vulnerabilities
Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header (CVE-2013-4286).
Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).
Apache Tomcat 7.x before 7.0.50 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).
- Record
MGASA-2014-0148- Updated
- 2026-11-02
OSVMGASA-2014-0149 No score
Updated tomcat package fixes security vulnerabilities
Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).
Apache Tomcat 7.x before 7.0.50 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).
- Record
MGASA-2014-0149- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4590 No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
UBUNTU-CVE-2013-4590- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 6.0.39 | 6.0.39 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.50 | 7.0.50 |
org.apache.tomcat:tomcatMaven |
8.0.0-RC1 to 8.0.0-RC9 | 8.0.0-RC10 |
tomcat6Debian:6.0 |
before 6.0.41-2+squeeze5, plus listed versions 6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2 Show 21 moreShow less6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-16.0.35-1+squeeze26.0.35-1+squeeze36.0.35-1+squeeze46.0.35-26.0.35-36.0.35-46.0.35-56.0.35-5+nmu16.0.35-66.0.35-76.0.37-16.0.39-16.0.41-16.0.41-2 |
6.0.41-2+squeeze5 |
tomcat6Debian:7 |
before 6.0.45+dfsg-1~deb7u1, plus listed versions 6.0.35-66.0.35-6+deb7u16.0.35-76.0.37-16.0.39-1 Show 8 moreShow less6.0.41-16.0.41-26.0.41-2+squeeze56.0.41-2+squeeze66.0.41-2+squeeze76.0.41-36.0.41-46.0.45-1~deb6u1 |
6.0.45+dfsg-1~deb7u1 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.50, plus listed versions 7.0.357.0.377.0.397.0.407.0.417.0.427.0.47 |
7.0.50 |
org.apache.tomcat:tomcatMaven |
8.0.0-RC1 up to 8.0.0-RC10, plus listed versions 8.0.0-RC38.0.0-RC5 |
8.0.0-RC10 |
tomcatMageia:3 |
before 7.0.52-1.mga3 | 7.0.52-1.mga3 |
tomcatMageia:4 |
before 7.0.52-1.mga4 | 7.0.52-1.mga4 |
tomcat6Red Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
Show 154 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::client |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6Red Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6Red Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::server |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6Red Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation |
before 0:6.0.24-78.el6_5 | 0:6.0.24-78.el6_5 |
antlr-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.7.7-17.redhat_4.1.ep6.el6 | 0:2.7.7-17.redhat_4.1.ep6.el6 |
apache-commons-collections-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:3.2.1-15.redhat_3.1.ep6.el6 | 0:3.2.1-15.redhat_3.1.ep6.el6 |
apache-commons-collections-tomcat-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:3.2.1-15.redhat_3.1.ep6.el6 | 0:3.2.1-15.redhat_3.1.ep6.el6 |
apache-commons-daemon-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 1:1.0.15-5.redhat_1.ep6.el6 | 1:1.0.15-5.redhat_1.ep6.el6 |
apache-commons-daemon-jsvc-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 1:1.0.15-6.redhat_2.ep6.el6 | 1:1.0.15-6.redhat_2.ep6.el6 |
apache-commons-daemon-jsvc-eap6-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 1:1.0.15-6.redhat_2.ep6.el6 | 1:1.0.15-6.redhat_2.ep6.el6 |
apache-commons-logging-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.1.1-7.9_redhat_1.ep6.el6 | 0:1.1.1-7.9_redhat_1.ep6.el6 |
apache-commons-logging-tomcat-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.1.1-7.9_redhat_1.ep6.el6 | 0:1.1.1-7.9_redhat_1.ep6.el6 |
apache-commons-pool-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.6-7.redhat_6.1.ep6.el6 | 0:1.6-7.redhat_6.1.ep6.el6 |
apache-commons-pool-tomcat-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.6-7.redhat_6.1.ep6.el6 | 0:1.6-7.redhat_6.1.ep6.el6 |
dom4j-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.6.1-20.redhat_6.1.ep6.el6 | 0:1.6.1-20.redhat_6.1.ep6.el6 |
ecj3Red Hat:jboss_enterprise_web_server:2::el6 |
before 1:3.7.2-9.redhat_3.1.ep6.el6 | 1:3.7.2-9.redhat_3.1.ep6.el6 |
hibernate4-c3p0-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
hibernate4-core-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
hibernate4-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
hibernate4-entitymanager-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
hibernate4-envers-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
hibernate4-infinispan-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
httpdRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.2.26-35.ep6.el6 | 0:2.2.26-35.ep6.el6 |
httpd-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.2.26-35.ep6.el6 | 0:2.2.26-35.ep6.el6 |
httpd-develRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.2.26-35.ep6.el6 | 0:2.2.26-35.ep6.el6 |
httpd-manualRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.2.26-35.ep6.el6 | 0:2.2.26-35.ep6.el6 |
httpd-toolsRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.2.26-35.ep6.el6 | 0:2.2.26-35.ep6.el6 |
javassist-eap6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:3.18.1-1.GA_redhat_1.1.ep6.el6 | 0:3.18.1-1.GA_redhat_1.1.ep6.el6 |
jboss-loggingRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:3.1.4-1.GA_redhat_1.1.ep6.el6 | 0:3.1.4-1.GA_redhat_1.1.ep6.el6 |
jboss-transaction-api_1.1_specRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.0.1-12.Final_redhat_2.2.ep6.el6 | 0:1.0.1-12.Final_redhat_2.2.ep6.el6 |
mod_clusterRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el6 | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
mod_cluster-nativeRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.9-3.Final_redhat_2.ep6.el6 | 0:1.2.9-3.Final_redhat_2.ep6.el6 |
mod_cluster-native-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.9-3.Final_redhat_2.ep6.el6 | 0:1.2.9-3.Final_redhat_2.ep6.el6 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el6 | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
mod_cluster-tomcat7Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el6 | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
mod_jkRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.40-2.redhat_1.ep6.el6 | 0:1.2.40-2.redhat_1.ep6.el6 |
mod_jk-ap22Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.40-2.redhat_1.ep6.el6 | 0:1.2.40-2.redhat_1.ep6.el6 |
mod_jk-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.40-2.redhat_1.ep6.el6 | 0:1.2.40-2.redhat_1.ep6.el6 |
mod_jk-manualRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.2.40-2.redhat_1.ep6.el6 | 0:1.2.40-2.redhat_1.ep6.el6 |
mod_rtRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.4.1-6.GA.ep6.el6 | 0:2.4.1-6.GA.ep6.el6 |
mod_rt-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.4.1-6.GA.ep6.el6 | 0:2.4.1-6.GA.ep6.el6 |
mod_snmpRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.4.1-13.GA.ep6.el6 | 0:2.4.1-13.GA.ep6.el6 |
mod_snmp-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:2.4.1-13.GA.ep6.el6 | 0:2.4.1-13.GA.ep6.el6 |
mod_sslRed Hat:jboss_enterprise_web_server:2::el6 |
before 1:2.2.26-35.ep6.el6 | 1:2.2.26-35.ep6.el6 |
storeconfig-tc6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6 | 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6 |
storeconfig-tc7Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6 | 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.1.30-2.redhat_1.ep6.el6 | 0:1.1.30-2.redhat_1.ep6.el6 |
tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:1.1.30-2.redhat_1.ep6.el6 | 0:1.1.30-2.redhat_1.ep6.el6 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:6.0.41-5_patch_02.ep6.el6 | 0:6.0.41-5_patch_02.ep6.el6 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el6 |
before 0:7.0.54-6_patch_02.ep6.el6 | 0:7.0.54-6_patch_02.ep6.el6 |
antlr-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.7.7-17.redhat_4.1.ep6.el5 | 0:2.7.7-17.redhat_4.1.ep6.el5 |
apache-commons-collections-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:3.2.1-15.redhat_3.1.ep6.el5 | 0:3.2.1-15.redhat_3.1.ep6.el5 |
apache-commons-collections-tomcat-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:3.2.1-15.redhat_3.1.ep6.el5 | 0:3.2.1-15.redhat_3.1.ep6.el5 |
apache-commons-daemon-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 1:1.0.15-5.redhat_1.ep6.el5 | 1:1.0.15-5.redhat_1.ep6.el5 |
apache-commons-daemon-jsvc-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 1:1.0.15-6.redhat_2.ep6.el5 | 1:1.0.15-6.redhat_2.ep6.el5 |
apache-commons-pool-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.6-7.redhat_6.1.ep6.el5 | 0:1.6-7.redhat_6.1.ep6.el5 |
apache-commons-pool-tomcat-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.6-7.redhat_6.1.ep6.el5 | 0:1.6-7.redhat_6.1.ep6.el5 |
dom4j-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.6.1-20.redhat_6.1.ep6.el5 | 0:1.6.1-20.redhat_6.1.ep6.el5 |
ecj3Red Hat:jboss_enterprise_web_server:2::el5 |
before 1:3.7.2-9.redhat_3.1.ep6.el5 | 1:3.7.2-9.redhat_3.1.ep6.el5 |
hibernate4-c3p0-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
hibernate4-core-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
hibernate4-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
hibernate4-entitymanager-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
hibernate4-envers-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
hibernate4-infinispan-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
httpdRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.2.26-35.ep6.el5 | 0:2.2.26-35.ep6.el5 |
httpd-develRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.2.26-35.ep6.el5 | 0:2.2.26-35.ep6.el5 |
httpd-manualRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.2.26-35.ep6.el5 | 0:2.2.26-35.ep6.el5 |
httpd-toolsRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.2.26-35.ep6.el5 | 0:2.2.26-35.ep6.el5 |
javassist-eap6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:3.18.1-1.GA_redhat_1.1.ep6.el5 | 0:3.18.1-1.GA_redhat_1.1.ep6.el5 |
jboss-loggingRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:3.1.4-1.GA_redhat_1.1.ep6.el5 | 0:3.1.4-1.GA_redhat_1.1.ep6.el5 |
jboss-transaction-api_1.1_specRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.0.1-12.Final_redhat_2.2.ep6.el5 | 0:1.0.1-12.Final_redhat_2.2.ep6.el5 |
mod_clusterRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el5 | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
mod_cluster-nativeRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.9-3.Final_redhat_2.ep6.el5 | 0:1.2.9-3.Final_redhat_2.ep6.el5 |
mod_cluster-tomcat6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el5 | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
mod_cluster-tomcat7Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.9-1.Final_redhat_1.1.ep6.el5 | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
mod_jkRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.40-2.redhat_1.ep6.el5 | 0:1.2.40-2.redhat_1.ep6.el5 |
mod_jk-ap22Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.40-2.redhat_1.ep6.el5 | 0:1.2.40-2.redhat_1.ep6.el5 |
mod_jk-manualRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.2.40-2.redhat_1.ep6.el5 | 0:1.2.40-2.redhat_1.ep6.el5 |
mod_rtRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.4.1-6.GA.ep6.el5 | 0:2.4.1-6.GA.ep6.el5 |
mod_snmpRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:2.4.1-13.GA.ep6.el5 | 0:2.4.1-13.GA.ep6.el5 |
mod_sslRed Hat:jboss_enterprise_web_server:2::el5 |
before 1:2.2.26-35.ep6.el5 | 1:2.2.26-35.ep6.el5 |
storeconfig-tc6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5 | 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5 |
storeconfig-tc7Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5 | 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:1.1.30-2.redhat_1.ep6.el5 | 0:1.1.30-2.redhat_1.ep6.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:6.0.41-6_patch_02.ep6.el5 | 0:6.0.41-6_patch_02.ep6.el5 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el5 |
before 0:7.0.54-6_patch_02.ep6.el5 | 0:7.0.54-6_patch_02.ep6.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4590 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published February 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.49%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 6.0.39.
References
vmware.com/security/advisories/VMSA-2014-0008.html
mandriva.com/security/advisories?name=MDVSA-2015:052
secunia.com/advisories/59724
debian.org/security/2016/dsa-3530
tomcat.apache.org/security-7.html
Show 71 moreShow less
oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www-01.ibm.com/support/docview.wss?uid=swg21677147
svn.apache.org/viewvc?view=revision&revision=1549528
advisories.mageia.org/MGASA-2014-0148.html
bugzilla.redhat.com/show_bug.cgi?id=1069911
securityfocus.com/bid/65768
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
marc.info?l=bugtraq&m=144498216801440&w=2
lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2013-4590
github.com/apache/tomcat/commit/05c84ff8304a69a30b251f207a7b93c2c882564d
bugs.mageia.org/show_bug.cgi?id=12955
access.redhat.com/errata/RHSA-2014:1038
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1038.json
cve.org/CVERecord?id=CVE-2013-4590
httpd.apache.org/security/vulnerabilities_24.html
ubuntu.com/security/CVE-2013-4590