CVE-2021-25329 (CNNVD-202103-006)
HIGH
中文标题:
Apache Tomcat 安全漏洞
英文标题:
Incomplete fix for CVE-2020-9484
CVSS分数:
7.0
发布时间:
2021-03-01 12:00:20
漏洞类型:
其他
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat存在安全漏洞，该漏洞源于Tomcat实例仍然容易受到CVE-2020-9494的攻击。以下产品及版本受到影响：Apache Tomcat 10.0.0-M1版本至10.0.0-M9版本，9.0.0.0版本至9.0.41版本，8.5.0版本至8.5.61版本，7.0.0版本至7.0.107版本。
英文描述:
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
CWE类型:
（暂无数据）
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | - | < 10.0.0 | - |
cpe:2.3:a:apache_software_foundation:apache_tomcat:*:*:*:*:*:*:*:*
|
| apache | tomcat | * | - | - |
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
|
| apache | tomcat | 9.0.0 | - | - |
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
|
| apache | tomcat | 10.0.0 | - | - |
cpe:2.3:a:apache:tomcat:10.0.0:-:*:*:*:*:*:*
|
| debian | debian_linux | 9.0 | - | - |
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 10.0 | - | - |
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
| oracle | agile_plm | 9.3.3 | - | - |
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
|
| oracle | agile_plm | 9.3.6 | - | - |
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_policy | 1.14.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 1.6.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.6.0:*:*:*:*:*:*:*
|
| oracle | communications_instant_messaging_server | 10.0.1.5.0 | - | - |
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
|
| oracle | database | 12.2.0.1 | - | - |
cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*
|
| oracle | database | 19c | - | - |
cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*
|
| oracle | database | 21c | - | - |
cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:*
|
| oracle | graph_server_and_client | * | - | - |
cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*
|
| oracle | instantis_enterprisetrack | 17.1 | - | - |
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
|
| oracle | instantis_enterprisetrack | 17.2 | - | - |
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
|
| oracle | instantis_enterprisetrack | 17.3 | - | - |
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
|
| oracle | managed_file_transfer | 12.2.1.3.0 | - | - |
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
|
| oracle | managed_file_transfer | 12.2.1.4.0 | - | - |
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
| oracle | mysql_enterprise_monitor | * | - | - |
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
|
| oracle | siebel_ui_framework | * | - | - |
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
|
| oracle | siebel_ui_framework | 21.9 | - | - |
cpe:2.3:a:oracle:siebel_ui_framework:21.9:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题
x_refsource_MISC
cve.org
访问
cve.org
[tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)
mailing-list
cve.org
访问
cve.org
[announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)
mailing-list
cve.org
访问
cve.org
[tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence)
mailing-list
cve.org
访问
cve.org
[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml
mailing-list
cve.org
访问
cve.org
[oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484
mailing-list
cve.org
访问
cve.org
[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update
mailing-list
cve.org
访问
cve.org
DSA-4891
vendor-advisory
cve.org
访问
cve.org
[tomcat-users] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5
mailing-list
cve.org
访问
cve.org
[tomcat-users] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5
mailing-list
cve.org
访问
cve.org
[tomcat-users] 20210702 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5
mailing-list
cve.org
访问
cve.org
[tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5
mailing-list
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
GLSA-202208-34
vendor-advisory
cve.org
访问
cve.org
CVSS评分详情
7.0
HIGH
CVSS向量:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS版本:
3.1
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2021-03-01 12:00:20
修改时间:
2025-02-13 16:27:48
创建时间:
2025-11-11 15:36:44
更新时间:
2025-11-11 15:56:38
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-25329 |
2025-11-11 15:20:52 | 2025-11-11 07:36:44 |
| NVD | nvd_CVE-2021-25329 |
2025-11-11 14:57:34 | 2025-11-11 07:45:03 |
| CNNVD | cnnvd_CNNVD-202103-006 |
2025-11-11 15:10:35 | 2025-11-11 07:56:38 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:56:38
vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-202103-006; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202103-006
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:45:03
severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.0; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 4 → 23; references_count: 18 → 17; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 7.0
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 4 -> 23
- references_count: 18 -> 17
- data_sources: ['cve'] -> ['cve', 'nvd']