### Vendor:
The Apache Software Foundation
### Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.4
Apache Tomcat 8.5.0 to 8.5.27
Apache Tomcat 8.0.0.RC1 to 8.0.49
Apache Tomcat 7.0.0 to 7.0.84
### Description:
Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.
### Mitigation:
Users of the affected versions should apply one of the following
mitigations. Upgrade to:
- Apache Tomcat 9.0.5 or later
- Apache Tomcat 8.5.28 or later
- Apache Tomcat 8.0.50 or later
- Apache Tomcat 7.0.85 or later
暂无评论