boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2018-1305

CVE-2018-1305MEDIUM
Apache Software Foundation Apache Tomcat — Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .1447   96.6     —
AFFECTED
  Product        Versions                                                                                  Fixed
  Apache Tomcat  Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 –  —
TIMELINE
  Dec 7   Reserved by apache
  Feb 23  Published (CNA: apache)
  Oct 15  ENRICHED — CVE-2018-1305 (Apache Software Foundation Apache Tomcat). Received CVSS 6.5 and CPE data from NVD.
CNA: apache · CVSS v3.0 · 35 references · NVD status: Modified

Description

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
December 7, 2017ReservedReserved by apache
February 23, 2018PublishedPublished (CNA: apache)
October 15, 2026ENRICHEDENRICHED — CVE-2018-1305 (Apache Software Foundation Apache Tomcat). Received CVSS 6.5 and CPE data from NVD.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Apache Software FoundationApache Tomcat—Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84—

References (35)

Related

Authoritative record: CVE-2018-1305 at cve.org

Vendors: apache

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2018-1305 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.