CVE-2018-8014: tomcat from 7.0.41 (inclusive), through 7.0.88 (inclusive), from 8.0.0 (inclusive), through 8.0.52 (inclusive), from…

Affected technology

tomcat · from 7.0.41 (inclusive), through 7.0.88 (inclusive)
apache

tomcat · from 8.0.0 (inclusive), through 8.0.52 (inclusive)
apache

tomcat · from 8.5.0 (inclusive), through 8.5.31 (inclusive)
apache

tomcat · from 9.0.0 (inclusive), through 9.0.8 (inclusive)
apache

tomcat · 8.0.0 · update rc1
apache

tomcat · 9.0.0 · update milestone1
apache

ubuntu linux · 14.04
canonical

ubuntu linux · 16.04
canonical

ubuntu linux · 17.10
canonical

ubuntu linux · 18.04
canonical

debian linux · 8.0
debian

oncommand insight · Version not applicable in the source CPE
netapp

oncommand unified manager · from 9.4 (inclusive)
netapp

oncommand workflow automation · Version not applicable in the source CPE
netapp

snapcenter server · Version not applicable in the source CPE
netapp

storage automation store · Version not applicable in the source CPE
netapp

oncommand unified manager · from 7.3 (inclusive)
netapp

Apache Tomcat · 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.0 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.