CVE-2018-8031 Apache TomEE console vulnerable to Cross-site Scripting

What is CVE-2018-8031?

CVE-2018-8031 is a medium-severity cross-site scripting vulnerability in Apache TomEE, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.

Weakness: CWE-79

Which versions are affected by CVE-2018-8031?

2 open source packages ship an affected version, including org.apache.tomee:tomee-webapp. It affects 1 product.

Products include Apache Tomee.

How do I fix CVE-2018-8031?

Upgrade org.apache.tomee:tomee-webapp to 7.0.5 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-8031 being exploited?

There is no known exploitation of CVE-2018-8031 in the wild and no public exploit code.

Other vulnerabilities in Apache TomEE

• CVE-2020-13931 Remote code execution in Apache TomEE Critical 9.8
• CVE-2020-11969 Missing Authentication for Critical Function in Apache TomEE Critical 9.8
• CVE-2019-13990 XML external entity injection in Terracotta Quartz Scheduler Critical 9.8
• CVE-2016-0779 Deserialization in n/a Critical 9.8
• CVE-2019-17359 Out-of-Memory Error in Bouncy Castle Crypto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fg44-w3fr-hgxv.