boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2018-1304

CVE-2018-1304MEDIUM
Apache Software Foundation Apache Tomcat — The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  N  N    5.9   .1707   97.1     —
AFFECTED
  Product        Versions                                                                                  Fixed
  Apache Tomcat  Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 –  —
TIMELINE
  Dec 7   Reserved by apache
  Feb 28  Published (CNA: apache)
  Oct 15  ENRICHED — CVE-2018-1304 (Apache Software Foundation Apache Tomcat). Received CVSS 5.9 and CPE data from NVD.
CNA: apache · CVSS v3.0 · 40 references · NVD status: Modified

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
December 7, 2017ReservedReserved by apache
February 28, 2018PublishedPublished (CNA: apache)
October 15, 2026ENRICHEDENRICHED — CVE-2018-1304 (Apache Software Foundation Apache Tomcat). Received CVSS 5.9 and CPE data from NVD.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Apache Software FoundationApache Tomcat—Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84—

References (40)

Related

Authoritative record: CVE-2018-1304 at cve.org

Vendors: apache

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2018-1304 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.