Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2013-4590

CVE-2013-4590MEDIUM

n/a n/a — Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by le…

  AV  AC  Au  C  I  A   CVSS    EPSS   %ile   KEV
   N   M   N  P  N  N    4.3   .0949   95.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 12  Reserved by redhat
  Feb 26  Published (CNA: redhat)
  Oct 9   ENRICHED — CVE-2013-4590. Received CVSS 4.3 and CPE data from NVD.

CWE-200 · CNA: redhat · CVSS v2.0 · 31 references · NVD status: Modified

Description

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 12, 2013	Reserved	Reserved by redhat
February 26, 2014	Published	Published (CNA: redhat)
October 9, 2026	ENRICHED	ENRICHED — CVE-2013-4590. Received CVSS 4.3 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	n/a	—	n/a	—

Weaknesses

CWE-200

References (31)

http://advisories.mageia.org/MGASA-2014-0148.html [Third Party Advisory]
http://marc.info/?l=bugtraq&m=144498216801440&w=2 [Mailing List]
http://secunia.com/advisories/59036 [Permissions Required, Third Party Advisory]
http://secunia.com/advisories/59722 [Permissions Required, Third Party Advisory]
http://secunia.com/advisories/59724 [Permissions Required, Third Party Advisory]
http://secunia.com/advisories/59873 [Permissions Required, Third Party Advisory]
http://svn.apache.org/viewvc?view=revision&revision=1549528 [Issue Tracking]
http://svn.apache.org/viewvc?view=revision&revision=1549529 [Issue Tracking]
http://svn.apache.org/viewvc?view=revision&revision=1558828 [Issue Tracking]
http://tomcat.apache.org/security-6.html [Vendor Advisory]
http://tomcat.apache.org/security-7.html [Vendor Advisory]
http://tomcat.apache.org/security-8.html [Vendor Advisory]
http://www-01.ibm.com/support/docview.wss?uid=swg21667883 [Third Party Advisory]
http://www-01.ibm.com/support/docview.wss?uid=swg21675886 [Third Party Advisory]
http://www-01.ibm.com/support/docview.wss?uid=swg21677147 [Third Party Advisory]
http://www-01.ibm.com/support/docview.wss?uid=swg21678231 [Third Party Advisory]
http://www.debian.org/security/2016/dsa-3530 [Third Party Advisory]
http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 [Third Party Advisory]
http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 [Third Party Advisory]
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html [Third Party Advisory]
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
http://www.securityfocus.com/bid/65768 [Third Party Advisory, VDB Entry]
http://www.vmware.com/security/advisories/VMSA-2014-0008.html
https://bugzilla.redhat.com/show_bug.cgi?id=1069911 [Issue Tracking]
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

Authoritative record: CVE-2013-4590 at cve.org

Weaknesses: CWE-200

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2013-4590 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.