製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性

タイトル	Apache Commons FileUpload におけるサービス運用妨害 (DoS) の脆弱性
概要	Apache Commons FileUpload には、サービス運用妨害 (DoS) の脆弱性が存在します。 Apache Software Foundation が提供する Apache Commons FileUpload には、マルチパートリクエストの処理に問題があり、当該処理が無限ループになる脆弱性が存在します。 [2014年2月12日 - 追記] JPCERT/CC では、攻撃ツールが公開されていることを確認しています。この脆弱性情報は、情報セキュリティ早期警戒パートナーシップに基づき下記の方が IPA に報告し、JPCERT/CC が開発者との調整を行いました。報告者: Hitachi Incident Response Team (HIRT)
想定される影響	細工されたリクエストを処理すると、対象のシステムを応答不能な状態にされる可能性があります。
対策	[アップデートする] 本脆弱性を修正した各製品のアップデートが公開されました。開発者の提供する情報をもとに、最新版にアップデートしてください。　* Apache Commons FileUpload 1.3.1 　　http://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi 　* Apache Tomcat 8.0.3 　　http://www.apache.org/dist/tomcat/tomcat-8/v8.0.3/ 　* Apache Tomcat 7.0.52 　　http://www.apache.org/dist/tomcat/tomcat-7/v7.0.52/ 　* Apache Struts 2.3.16.1 　　http://struts.apache.org/download.cgi#struts23161 [パッチを適用する] 開発者のリポジトリでは、本脆弱性の修正コードが公開されています。　* Apache Commons FileUpload: http://svn.apache.org/r1565143 　* Apache Tomcat 8: http://svn.apache.org/r1565163 　* Apache Tomcat 7: http://svn.apache.org/r1565169 [ワークアラウンドを実施する] 以下の回避策を実施することで、本脆弱性の影響を軽減することが可能です。　* Content-Type ヘッダのサイズを 4091 バイト未満に制限する詳しくは、開発者が提供する情報をご確認ください。
公表日	2014年2月10日0:00
登録日	2014年2月10日14:01
最終更新日	2016年11月22日16:00

CVSS2.0 : 警告
スコア	5
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P

影響を受けるシステム

Apache Software Foundation

Apache Tomcat 7.0.0 から 7.0.50 まで

Apache Tomcat 8.0.0-RC1 から 8.0.1 まで

Commons FileUpload 1.0 から 1.3 まで

Commons FileUpload に依存するその他の Apache 製品

オラクル

Application Express 4.2.6 未満

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.2.2

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.3

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 2.4

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 3.0

Oracle Fusion Middleware の Oracle Endeca Information Discovery Studio 3.1

Oracle Fusion Middleware の Oracle Enterprise Data Quality 8.1.2

Oracle Fusion Middleware の Oracle Enterprise Data Quality 9.0.11

Oracle Fusion Middleware の Oracle JDeveloper 10.1.3.5

Oracle Fusion Middleware の Oracle JDeveloper 11.1.1.7

Oracle Fusion Middleware の Oracle JDeveloper 11.1.2.4

Oracle Fusion Middleware の Oracle JDeveloper 12.1.2.0

Oracle Fusion Middleware の Oracle JDeveloper 12.1.3.0

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Inspections 1.0.1.0 およびそれ以前

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Signal 7.3.3.3 およびそれ以前

Oracle Health Sciences Applications の Oracle Health Sciences Empirica Study 3.1.2.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0050	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050
National Vulnerability Database (NVD)
2	CVE-2014-0050	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0050

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	名前	URL
Apache Software Foundation
1	Download Apache Commons FileUpload -- Apache Commons FileUpload 1.3.1	http://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi
2	www-announce mailing list archives -- CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS	http://mail-archives.us.apache.org/mod_mbox/www-announce/201402.mbox/%3C52F373FC.9030907@apache.org%3E
Apache Struts
3	Struts 2.3.16.1	http://struts.apache.org/download.cgi#struts23161
Apache Struts Announcements
4	21 February 2014 - Immediately upgrade commons-fileupload to version 1.3.1	http://struts.apache.org/announce.html#a20140221
Apache Tomcat
5	Apache Tomcat 7.0.52	http://www.apache.org/dist/tomcat/tomcat-7/v7.0.52/
6	Apache Tomcat 8.0.3	http://www.apache.org/dist/tomcat/tomcat-8/v8.0.3/
7	Fixed in Apache Tomcat 7.0.51	http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.51
8	Fixed in Apache Tomcat 8.0.2	http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.2
Apache-SVN
9	Apache Commons FileUpload 1.3.1 RELEASE NOTES	http://svn.apache.org/viewvc/commons/proper/fileupload/trunk/RELEASE-NOTES.txt?view=markup&pathrev=1565338
10	[Apache-SVN] Revision 1565143	http://svn.apache.org/viewvc?view=revision&revision=r1565143
Hitachi Software Vulnerability Information
11	HS14-008	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-008/index.html
12	HS14-015	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
13	HS14-016	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
14	HS14-017	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
IBM Support Document
15	1669554	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
16	1675432	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
17	1676091	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
18	1676092	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
19	1676401	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
20	1676403	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
21	1676405	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
22	1676410	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
23	1676656	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
24	1676853	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
25	1677691	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
26	1677724	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
27	1681214	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
NEC製品セキュリティ情報
28	NV15-004	http://jpn.nec.com/security-info/secinfo/nv15-004.html
Oracle Critical Patch Update
29	Oracle Critical Patch Update Advisory - April 2015	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
30	Oracle Critical Patch Update Advisory - January 2015	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
31	Oracle Critical Patch Update Advisory - January 2016	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
32	Oracle Critical Patch Update Advisory - July 2014	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
33	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
34	Oracle Critical Patch Update Advisory - October 2015	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
35	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
36	Text Form of Oracle Critical Patch Update - April 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuapr2015verbose-2365613.html
37	Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html
38	Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html
39	Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2014verbose-1972958.html
40	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
41	Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2015verbose-2367954.html
42	Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices	http://www.oracle.com/technetwork/security-advisory/cpuoct2016verbose-2881725.html
Red Hat Bugzilla
43	Bug 1062337	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
Red Hat Security Advisory
44	RHSA-2014:0400	http://rhn.redhat.com/errata/RHSA-2014-0400.html
Security Advisory
45	Huawei-SA-20140707-01-Struts2	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
SECURITY BLOG
46	April 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/april_2015_critical_patch_update
47	January 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2015_critical_patch_update
48	January 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2016_critical_patch_update
49	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
50	October 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2015_critical_patch_update
51	October 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2016_critical_patch_update
VMware Security Advisories
52	VMSA-2014-0007	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
ソフトウェア製品セキュリティ情報
53	HS14-008	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-008/index.html
54	HS14-015	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-015/index.html
55	HS14-016	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-016/index.html
56	HS14-017	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-017/index.html
富士通セキュリティ情報
57	Interstage Application Server: Java EE 6におけるサービス運用妨害(DoS)の脆弱性(CVE-2014-0050)	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_as_201401.html

その他

No	名前	URL
JPCERT 緊急報告
1	Apache Commons FileUpload および Apache Tomcat の脆弱性に関する注意喚起	https://www.jpcert.or.jp/at/2014/at140007.html
JVN
2	JVN#14876762	http://jvn.jp/jp/JVN14876762/index.html
関連文書
3	MGASA-2014-0110	http://advisories.mageia.org/MGASA-2014-0110.html

変更履歴

No	変更内容	変更日
0	[2014年02月10日] 掲載 [2014年02月13日] 概要：内容を更新対策：内容を更新ベンダ情報：Apache Software Foundation (Apache Tomcat 8.0.3) を追加 [2014年02月21日] 対策：内容を更新ベンダ情報：Apache Software Foundation (Apache Tomcat 7.0.52) を追加 [2014年02月24日] ベンダ情報：Apache Software Foundation (21 February 2014 - Immediately upgrade commons-fileupload to version 1.3.1) を追加 [2014年03月10日] 対策：内容を更新ベンダ情報：Apache Software Foundation (Struts 2.3.16.1) を追加 [2014年03月28日] ベンダ情報：富士通 (Interstage Application Server: Java EE 6におけるサービス運用妨害(DoS)の脆弱性(CVE-2014-0050)) を追加 [2014年03月31日] ベンダ情報：日立 (HS14-008) を追加 [2014年04月02日] 参考情報：National Vulnerability Database (NVD) (CVE-2014-0050) を追加 [2014年05月13日] ベンダ情報：レッドハット (RHSA-2014:0400) を追加 [2014年07月01日] ベンダ情報：VMware (VMSA-2014-0007) を追加ベンダ情報：日立 (HS14-015) を追加ベンダ情報：日立 (HS14-016) を追加ベンダ情報：日立 (HS14-017) を追加 [2014年07月25日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：Huawei (Huawei-SA-20140707-01-Struts2) を追加ベンダ情報：IBM (1677724) を追加ベンダ情報：IBM (1676853) を追加ベンダ情報：IBM (1676656) を追加ベンダ情報：IBM (1676410) を追加ベンダ情報：IBM (1676405) を追加ベンダ情報：IBM (1676403) を追加ベンダ情報：IBM (1676401) を追加ベンダ情報：IBM (1675432) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices) を追加ベンダ情報：レッドハット (Bug 1062337) を追加 [2014年09月09日] ベンダ情報：IBM (1677691) を追加ベンダ情報：IBM (1681214) を追加 [2014年10月21日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices) を追加ベンダ情報：オラクル (October 2014 Critical Patch Update Released) を追加 [2015年01月30日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices) を追加ベンダ情報：オラクル (January 2015 Critical Patch Update Released) を追加 [2015年04月20日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - April 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - April 2015 Risk Matrices) を追加ベンダ情報：オラクル (April 2015 Critical Patch Update Released) を追加 [2015年05月11日] 参考情報：関連文書 (MGASA-2014-0110) を追加 [2015年06月08日] ベンダ情報：日本電気 (NV15-004) を追加 [2015年06月26日] ベンダ情報：IBM (1676091) を追加ベンダ情報：IBM (1676092) を追加ベンダ情報：IBM (1669554) を追加 [2015年10月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices) を追加ベンダ情報：オラクル (October 2015 Critical Patch Update Released) を追加 [2016年01月28日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices) を追加ベンダ情報：オラクル (January 2016 Critical Patch Update Released) を追加 [2016年11月22日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2016 Risk Matrices) を追加ベンダ情報：オラクル (October 2016 Critical Patch Update Released) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2014-0050

概要	MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
公表日	2014年4月1日15:27
登録日	2021年1月26日15:03
最終更新日	2024年11月21日11:01

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:oracle:retail_applications:12.0in:::::::*
cpe:2.3:a:oracle:retail_applications:13.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.3:::::::*
cpe:2.3:a:oracle:retail_applications:13.2:::::::*
cpe:2.3:a:oracle:retail_applications:12.0:::::::*
cpe:2.3:a:oracle:retail_applications:14.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.1:::::::*
cpe:2.3:a:oracle:retail_applications:13.4:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.49:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.46:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc2::::::
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.48:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.45:::::::*
cpe:2.3:a:apache:commons_fileupload::::::::		1.3
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.31:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.43:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:7.0.38:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.24:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:commons_fileupload:1.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://advisories.mageia.org/MGASA-2014-0110.html
2	http://advisories.mageia.org/MGASA-2014-0110.html
3	http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html	Exploit
4	http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html	Exploit
5	http://jvn.jp/en/jp/JVN14876762/index.html
6	http://jvn.jp/en/jp/JVN14876762/index.html
7	http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
8	http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
9	http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
10	http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
11	http://marc.info/?l=bugtraq&m=143136844732487&w=2
12	http://marc.info/?l=bugtraq&m=143136844732487&w=2
13	http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
14	http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
15	http://rhn.redhat.com/errata/RHSA-2014-0252.html
16	http://rhn.redhat.com/errata/RHSA-2014-0252.html
17	http://rhn.redhat.com/errata/RHSA-2014-0253.html
18	http://rhn.redhat.com/errata/RHSA-2014-0253.html
19	http://rhn.redhat.com/errata/RHSA-2014-0400.html
20	http://rhn.redhat.com/errata/RHSA-2014-0400.html
21	http://seclists.org/fulldisclosure/2014/Dec/23
22	http://seclists.org/fulldisclosure/2014/Dec/23
23	http://secunia.com/advisories/57915
24	http://secunia.com/advisories/57915
25	http://secunia.com/advisories/58075
26	http://secunia.com/advisories/58075
27	http://secunia.com/advisories/58976
28	http://secunia.com/advisories/58976
29	http://secunia.com/advisories/59039
30	http://secunia.com/advisories/59039
31	http://secunia.com/advisories/59041
32	http://secunia.com/advisories/59041
33	http://secunia.com/advisories/59183
34	http://secunia.com/advisories/59183
35	http://secunia.com/advisories/59184
36	http://secunia.com/advisories/59184
37	http://secunia.com/advisories/59185
38	http://secunia.com/advisories/59185
39	http://secunia.com/advisories/59187
40	http://secunia.com/advisories/59187
41	http://secunia.com/advisories/59232
42	http://secunia.com/advisories/59232
43	http://secunia.com/advisories/59399
44	http://secunia.com/advisories/59399
45	http://secunia.com/advisories/59492
46	http://secunia.com/advisories/59492
47	http://secunia.com/advisories/59500
48	http://secunia.com/advisories/59500
49	http://secunia.com/advisories/59725
50	http://secunia.com/advisories/59725
51	http://secunia.com/advisories/60475
52	http://secunia.com/advisories/60475
53	http://secunia.com/advisories/60753
54	http://secunia.com/advisories/60753
55	http://svn.apache.org/r1565143	Patch
56	http://svn.apache.org/r1565143	Patch
57	http://tomcat.apache.org/security-7.html	Patch Vendor Advisory
58	http://tomcat.apache.org/security-7.html	Patch Vendor Advisory
59	http://tomcat.apache.org/security-8.html	Patch Vendor Advisory
60	http://tomcat.apache.org/security-8.html	Patch Vendor Advisory
61	http://www.debian.org/security/2014/dsa-2856
62	http://www.debian.org/security/2014/dsa-2856
63	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
64	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
65	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
66	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
67	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
68	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
69	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
70	http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
71	http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
72	http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
73	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
74	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
75	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
76	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
77	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
78	http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
79	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
80	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
81	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
82	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
83	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
84	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
85	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
86	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
87	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
88	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
89	http://www.securityfocus.com/archive/1/532549/100/0/threaded
90	http://www.securityfocus.com/archive/1/532549/100/0/threaded
91	http://www.securityfocus.com/archive/1/534161/100/0/threaded
92	http://www.securityfocus.com/archive/1/534161/100/0/threaded
93	http://www.securityfocus.com/bid/65400
94	http://www.securityfocus.com/bid/65400
95	http://www.ubuntu.com/usn/USN-2130-1
96	http://www.ubuntu.com/usn/USN-2130-1
97	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
98	http://www.vmware.com/security/advisories/VMSA-2014-0007.html
99	http://www.vmware.com/security/advisories/VMSA-2014-0008.html
100	http://www.vmware.com/security/advisories/VMSA-2014-0008.html
101	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
102	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
103	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
104	http://www-01.ibm.com/support/docview.wss?uid=swg21669554
105	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
106	http://www-01.ibm.com/support/docview.wss?uid=swg21675432
107	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
108	http://www-01.ibm.com/support/docview.wss?uid=swg21676091
109	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
110	http://www-01.ibm.com/support/docview.wss?uid=swg21676092
111	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
112	http://www-01.ibm.com/support/docview.wss?uid=swg21676401
113	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
114	http://www-01.ibm.com/support/docview.wss?uid=swg21676403
115	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
116	http://www-01.ibm.com/support/docview.wss?uid=swg21676405
117	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
118	http://www-01.ibm.com/support/docview.wss?uid=swg21676410
119	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
120	http://www-01.ibm.com/support/docview.wss?uid=swg21676656
121	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
122	http://www-01.ibm.com/support/docview.wss?uid=swg21676853
123	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
124	http://www-01.ibm.com/support/docview.wss?uid=swg21677691
125	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
126	http://www-01.ibm.com/support/docview.wss?uid=swg21677724
127	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
128	http://www-01.ibm.com/support/docview.wss?uid=swg21681214
129	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
130	https://bugzilla.redhat.com/show_bug.cgi?id=1062337
131	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
132	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
133	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
134	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
135	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
136	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
137	https://security.gentoo.org/glsa/202107-39
138	https://security.gentoo.org/glsa/202107-39

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

構成1	以上	以下	より上	未満
cpe:2.3:a:oracle:retail_applications:12.0in:::::::*
cpe:2.3:a:oracle:retail_applications:13.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.3:::::::*
cpe:2.3:a:oracle:retail_applications:13.2:::::::*
cpe:2.3:a:oracle:retail_applications:12.0:::::::*
cpe:2.3:a:oracle:retail_applications:14.0:::::::*
cpe:2.3:a:oracle:retail_applications:13.1:::::::*
cpe:2.3:a:oracle:retail_applications:13.4:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:7.0.49:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:7.0.8:::::::*
cpe:2.3:a:apache:tomcat:7.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.46:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc2::::::
cpe:2.3:a:apache:tomcat:7.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.48:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:7.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.7:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.45:::::::*
cpe:2.3:a:apache:commons_fileupload::::::::		1.3
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:7.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.31:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.15:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:commons_fileupload:1.1.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.43:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:7.0.38:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:commons_fileupload:1.2.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.24:::::::*
cpe:2.3:a:apache:tomcat:7.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:7.0.9:::::::*
cpe:2.3:a:apache:commons_fileupload:1.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.3:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*