CVE-2018-8031
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a…
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Medium6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 2.0% · top 19% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
- Cross site scripting (XSS)
- CWE-79 (opens in a new tab)All about CWE-79 and its CVEs
Affected products
Apache Software Foundation · Apache TomEE
- affected < 7.0.5
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.tomee:tomee-webappGHSA-fg44-w3fr-hgxv (opens in a new tab)
References (1)
- [tomee-dev] 20180723 CVE-2018-8031 Apache TomEE Webapp XSS (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-fg44-w3fr-hgxv (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-8031)Record last updated .