Oracle Workload Manager vulnerabilities

10 CVEs affecting Oracle Workload Manager, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-17527, published 2020-12-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2020-13935, published 2020-07-14. High severity, CVSS 7.5. EPSS: 86.6% chance of exploitation in the next 30 days. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could…
CVE-2020-13934, published 2020-07-14. High severity, CVSS 7.5. EPSS: 64.1% chance of exploitation in the next 30 days. An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of…
CVE-2020-9484, published 2020-05-20. High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
CVE-2020-11996, published 2020-06-26. High severity, CVSS 7.5. EPSS: 26.7% chance of exploitation in the next 30 days. A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient…
CVE-2020-17527, published 2020-12-03. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream…
CVE-2020-1935, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 9.4% chance of exploitation in the next 30 days. In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as…
CVE-2019-17569, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 8.9% chance of exploitation in the next 30 days. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were…
CVE-2019-12418, published 2019-12-23. High severity, CVSS 7.0. EPSS: 1.2% chance of exploitation in the next 30 days. When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration…