UpHeron
All vulnerabilities

Servers and applications

CVE-2017-7674

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Severity
Medium 4.3
Published
11 Aug 2017
Last changed
15 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone21
  • Version 9.0.0-milestone20
  • Version 9.0.0-milestone19
  • Version 9.0.0-milestone18
All 123 release lines
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.43
  • Version 7.0.44
  • Version 7.0.45
  • Version 7.0.46
  • Version 7.0.47
  • Version 7.0.48
  • Version 7.0.49
  • Version 7.0.50
  • Version 7.0.52
  • Version 7.0.53
  • Version 7.0.54
  • Version 7.0.55
  • Version 7.0.56
  • Version 7.0.57
  • Version 7.0.58
  • Version 7.0.59
  • Version 7.0.60
  • Version 7.0.61
  • Version 7.0.62
  • Version 7.0.63
  • Version 7.0.64
  • Version 7.0.65
  • Version 7.0.66
  • Version 7.0.67
  • Version 7.0.68
  • Version 7.0.69
  • Version 7.0.70
  • Version 7.0.71
  • Version 7.0.72
  • Version 7.0.73
  • Version 7.0.74
  • Version 7.0.75
  • Version 7.0.76
  • Version 7.0.77
  • Version 7.0.78
  • Version 8.0.0-rc1
  • Version 8.0.0-rc3
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0
  • Version 8.0.1
  • Version 8.0.2
  • Version 8.0.3
  • Version 8.0.4
  • Version 8.0.5
  • Version 8.0.6
  • Version 8.0.7
  • Version 8.0.8
  • Version 8.0.9
  • Version 8.0.10
  • Version 8.0.11
  • Version 8.0.12
  • Version 8.0.13
  • Version 8.0.14
  • Version 8.0.15
  • Version 8.0.16
  • Version 8.0.17
  • Version 8.0.18
  • Version 8.0.19
  • Version 8.0.20
  • Version 8.0.21
  • Version 8.0.22
  • Version 8.0.23
  • Version 8.0.24
  • Version 8.0.25
  • Version 8.0.26
  • Version 8.0.27
  • Version 8.0.28
  • Version 8.0.29
  • Version 8.0.30
  • Version 8.0.31
  • Version 8.0.32
  • Version 8.0.33
  • Version 8.0.34
  • Version 8.0.35
  • Version 8.0.36
  • Version 8.0.37
  • Version 8.0.38
  • Version 8.0.39
  • Version 8.0.40
  • Version 8.0.41
  • Version 8.0.42
  • Version 8.0.43
  • Version 8.0.44
  • Version 8.5.0
  • Version 8.5.1
  • Version 8.5.2
  • Version 8.5.3
  • Version 8.5.4
  • Version 8.5.5
  • Version 8.5.6
  • Version 8.5.7
  • Version 8.5.8
  • Version 8.5.9
  • Version 8.5.10
  • Version 8.5.11
  • Version 8.5.12
  • Version 8.5.13
  • Version 8.5.14
  • Version 8.5.15
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone2
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone5
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone10
  • Version 9.0.0-milestone11
  • Version 9.0.0-milestone12
  • Version 9.0.0-milestone13
  • Version 9.0.0-milestone14
  • Version 9.0.0-milestone15
  • Version 9.0.0-milestone16
  • Version 9.0.0-milestone17
  • Version 9.0.0-milestone18
  • Version 9.0.0-milestone19
  • Version 9.0.0-milestone20
  • Version 9.0.0-milestone21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-7674
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-7674