CVE-2017-7674

—

CVSS 3.0

4.3 medium

EPSS

8%p94

Published

Aug 11, 2017 (Aug 11, 2017)

Modified

Jun 17, 2026

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Vendors: apache
Products: tomcat
Weakness: CWE-345
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (8.0%)

In the news0 stories

No ingested article mentions this CVE yet.