Executive Summary

Informations
NameCVE-2013-4590First vendor Publication2014-02-26
VendorCveLast vendor Modification2019-04-15

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4590

CWE : Common Weakness Enumeration

%idName
100 %CWE-200Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27228
 
Oval ID: oval:org.mitre.oval:def:27228
Title: ELSA-2014-1038 -- tomcat6 security update (low)
Description: [0:6.0.24-78] - Related: CVE-2013-4590 - remove xml schema names javaee_5, - javaee_web_services_1_2, and javaee_web_services_1_2_client - from descriptor.DigesterFactory initialization. These - schema definitions are not relevant to 6.0.24 as the version - of their spec did not exist at the time.
Family: unix Class: patch
Reference(s): ELSA-2014-1038
CVE-2014-0119
CVE-2013-4590
Version: 3
Platform(s): Oracle Linux 6
Product(s): tomcat6
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application241
Os1
Os1

Information Assurance Vulnerability Management (IAVM)

DateDescription
2014-09-18IAVM : 2014-B-0126 - Multiple Vulnerabilities in VMware ESXi 5.5
Severity : Category I - VMSKEY : V0054325
2014-02-27IAVM : 2014-B-0019 - Multiple Vulnerabilities in Apache Tomcat
Severity : Category I - VMSKEY : V0044527

Nessus® Vulnerability Scanner

DateDescription
2016-03-28Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3530.nasl - Type : ACT_GATHER_INFO
2015-12-30Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2014-0008_remote.nasl - Type : ACT_GATHER_INFO
2015-03-30Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-084.nasl - Type : ACT_GATHER_INFO
2015-03-19Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-052.nasl - Type : ACT_GATHER_INFO
2015-01-19Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_tomcat_20140522.nasl - Type : ACT_GATHER_INFO
2014-12-15Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-29.nasl - Type : ACT_GATHER_INFO
2014-12-15Name : The remote VMware ESXi 5.1 host is affected by multiple vulnerabilities.
File : vmware_esxi_5_1_build_2323231_remote.nasl - Type : ACT_GATHER_INFO
2014-12-12Name : The remote VMware ESXi 5.1 host is affected by multiple vulnerabilities.
File : vmware_esxi_5_1_build_2323236_remote.nasl - Type : ACT_GATHER_INFO
2014-11-26Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-09-29Name : The remote Fedora host is missing a security update.
File : fedora_2014-11048.nasl - Type : ACT_GATHER_INFO
2014-09-17Name : The remote host has an update manager installed that is affected by multiple ...
File : vmware_vcenter_update_mgr_vmsa-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-09-17Name : The remote host has a virtualization management application installed that is...
File : vmware_vcenter_vmsa-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-09-11Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2014-0008.nasl - Type : ACT_GATHER_INFO
2014-08-23Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1087.nasl - Type : ACT_GATHER_INFO
2014-08-23Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1088.nasl - Type : ACT_GATHER_INFO
2014-08-12Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-12Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1038.nasl - Type : ACT_GATHER_INFO
2014-08-12Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140811_tomcat6_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-02-25Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_6_0_39.nasl - Type : ACT_GATHER_INFO
2014-02-25Name : The remote Apache Tomcat server is affected by multiple vulnerabilities.
File : tomcat_7_0_50.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

SourceUrl
BID http://www.securityfocus.com/bid/65768
CONFIRM http://advisories.mageia.org/MGASA-2014-0148.html
http://svn.apache.org/viewvc?view=revision&revision=1549528
http://svn.apache.org/viewvc?view=revision&revision=1549529
http://svn.apache.org/viewvc?view=revision&revision=1558828
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://www-01.ibm.com/support/docview.wss?uid=swg21667883
http://www-01.ibm.com/support/docview.wss?uid=swg21675886
http://www-01.ibm.com/support/docview.wss?uid=swg21677147
http://www-01.ibm.com/support/docview.wss?uid=swg21678231
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
http://www.vmware.com/security/advisories/VMSA-2014-0008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1069911
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n...
DEBIAN http://www.debian.org/security/2016/dsa-3530
HP http://marc.info/?l=bugtraq&m=144498216801440&w=2
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2015:052
http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
MLIST https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930f...
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04cc...
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930...
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236...

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
DateInformations
2019-04-15 21:18:58
  • Multiple Updates
2019-04-15 17:18:44
  • Multiple Updates
2019-03-25 17:18:58
  • Multiple Updates
2019-03-21 21:19:10
  • Multiple Updates
2017-11-15 09:23:50
  • Multiple Updates
2017-01-07 09:25:13
  • Multiple Updates
2016-12-08 09:23:28
  • Multiple Updates
2016-11-18 21:24:31
  • Multiple Updates
2016-10-26 09:22:41
  • Multiple Updates
2016-10-15 12:02:57
  • Multiple Updates
2016-08-23 09:24:48
  • Multiple Updates
2016-04-26 09:25:15
  • Multiple Updates
2016-03-29 13:21:00
  • Multiple Updates
2015-04-02 09:25:36
  • Multiple Updates
2015-03-31 13:28:01
  • Multiple Updates
2015-03-20 13:28:46
  • Multiple Updates
2015-03-18 09:26:11
  • Multiple Updates
2015-01-21 13:26:23
  • Multiple Updates
2014-12-16 13:25:03
  • Multiple Updates
2014-09-30 13:27:27
  • Multiple Updates
2014-09-18 13:27:12
  • Multiple Updates
2014-09-12 13:27:10
  • Multiple Updates
2014-08-24 13:25:16
  • Multiple Updates
2014-08-13 13:24:40
  • Multiple Updates
2014-07-17 09:21:42
  • Multiple Updates
2014-02-28 17:19:13
  • Multiple Updates
2014-02-26 21:21:38
  • First insertion