7

CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 7.0.0 <= 7.0.107
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.61
Apache ≫ Tomcat Version >= 9.0.0 <= 9.0.41
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Apache ≫ Tomcat Version9.0.0 Updatemilestone10
Apache ≫ Tomcat Version9.0.0 Updatemilestone11
Apache ≫ Tomcat Version9.0.0 Updatemilestone12
Apache ≫ Tomcat Version9.0.0 Updatemilestone13
Apache ≫ Tomcat Version9.0.0 Updatemilestone14
Apache ≫ Tomcat Version9.0.0 Updatemilestone15
Apache ≫ Tomcat Version9.0.0 Updatemilestone16
Apache ≫ Tomcat Version9.0.0 Updatemilestone17
Apache ≫ Tomcat Version9.0.0 Updatemilestone18
Apache ≫ Tomcat Version9.0.0 Updatemilestone19
Apache ≫ Tomcat Version9.0.0 Updatemilestone2
Apache ≫ Tomcat Version9.0.0 Updatemilestone20
Apache ≫ Tomcat Version9.0.0 Updatemilestone21
Apache ≫ Tomcat Version9.0.0 Updatemilestone22
Apache ≫ Tomcat Version9.0.0 Updatemilestone23
Apache ≫ Tomcat Version9.0.0 Updatemilestone24
Apache ≫ Tomcat Version9.0.0 Updatemilestone25
Apache ≫ Tomcat Version9.0.0 Updatemilestone26
Apache ≫ Tomcat Version9.0.0 Updatemilestone27
Apache ≫ Tomcat Version9.0.0 Updatemilestone3
Apache ≫ Tomcat Version9.0.0 Updatemilestone4
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Apache ≫ Tomcat Version10.0.0 Update-
Apache ≫ Tomcat Version10.0.0 Updatemilestone1
Apache ≫ Tomcat Version10.0.0 Updatemilestone10
Apache ≫ Tomcat Version10.0.0 Updatemilestone2
Apache ≫ Tomcat Version10.0.0 Updatemilestone3
Apache ≫ Tomcat Version10.0.0 Updatemilestone4
Apache ≫ Tomcat Version10.0.0 Updatemilestone5
Apache ≫ Tomcat Version10.0.0 Updatemilestone6
Apache ≫ Tomcat Version10.0.0 Updatemilestone7
Apache ≫ Tomcat Version10.0.0 Updatemilestone8
Apache ≫ Tomcat Version10.0.0 Updatemilestone9
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Oracle ≫ Agile Plm Version9.3.3
Oracle ≫ Agile Plm Version9.3.6
Oracle ≫ Database Version12.2.0.1 SwEditionenterprise
Oracle ≫ Database Version19c SwEditionenterprise
Oracle ≫ Database Version21c SwEditionenterprise
Oracle ≫ Graph Server And Client Version < 21.3.0
Oracle ≫ Managed File Transfer Version12.2.1.3.0
Oracle ≫ Managed File Transfer Version12.2.1.4.0
Oracle ≫ Mysql Enterprise Monitor Version <= 8.0.23
Oracle ≫ Siebel Ui Framework Version < 21.9
Oracle ≫ Siebel Ui Framework Version21.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.8% 0.733
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P