CVE-2018-8014: Apache Tomcat

Critical severity, CVSS 9.8. EPSS: 21.3% chance of exploitation in the next 30 days.

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

Affected products

• Apache Tomcat: from 7.0.41, up to and including 7.0.88; from 8.0.0, up to and including 8.0.52; from 8.5.0, up to and including 8.5.31; from 9.0.0, up to and including 9.0.8; version 8.0.0 only; version 9.0.0 only
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• Debian Debian Linux: version 8.0 only
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Unified Manager: from 9.4; from 7.3
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Snapcenter Server: affected versions not specified
• Netapp Storage Automation Store: affected versions not specified

Published 2018-05-16. Last modified 2026-06-17.