Apache Tomcat 7

Plugin 106975 is really two Tomcat 7 issues fixed in 7.0.85: CVE-2018-1305, where Servlet annotation-based security constraints were enforced only after the target Servlet had loaded, and CVE-2018-1304, where a security constraint mapped to the empty-string context root could be ignored. Affected upstream Tomcat is 7.0.0 through 7.0.84; the bug lives in Tomcat, but exploitation depends on how the hosted application defines access controls.

Tenable calling this MEDIUM is defensible in a vacuum, but for enterprise patch triage it's a little hot. The scanner is version-only, the reachable population is much smaller than 'all Tomcat 7', there is no KEV listing or meaningful exploitation signal, and the blast radius is usually limited to specific protected paths inside a single webapp rather than immediate server takeover.

Why this verdict

• Downward pressure: version-only detection — Tenable 106975 does not test exploitability; it flags any Tomcat <7.0.85, so many findings will be false positives for actual reachable impact.
• Downward pressure: attacker needs a specific app pattern — exploitation requires either empty-string context-root constraints or annotation-based constraints with favorable load order, which sharply narrows the exposed population.
• Downward pressure: blast radius is local to one webapp path — these CVEs yield unauthorized access to specific resources, not default RCE or Tomcat instance takeover.
• No threat amplifier — no KEV entry, no established mass-exploitation signal, and low EPSS compared with what we'd expect for internet-burning webapp bugs.

Why not higher?

This is not a generic unauthenticated Tomcat break. An attacker must land on a Tomcat deployment and a webapp using the exact broken security-constraint design, which means the vulnerable population is far smaller than the product install base. There is also no direct code execution path from these CVEs alone.

Why not lower?

It still affects a common public-facing platform, and when the bad pattern is present the outcome is real unauthorized access to protected resources. If one of your legacy apps relies on Tomcat for coarse-grained authz, this can become a quiet data-exposure bug rather than harmless noise.

1. Review app auth mappings — Inspect web.xml, annotation-based @ServletSecurity usage, and any context-root protections on affected Tomcat 7 apps. For a LOW verdict there is no SLA; do this as backlog hygiene during normal application review, prioritizing Internet-facing apps first.
2. Enforce auth upstream — Where feasible, require authentication and authorization at the reverse proxy, SSO gateway, or API gateway so Tomcat's local constraint handling is not the only guardrail. For LOW, deploy in normal change windows rather than breaking production for an edge-case bug.
3. Log protected-path denials and allows — Add monitoring for requests to admin or protected routes that return success without expected session or identity context. This helps you spot silent exposure while you work through routine remediation.

Run this on the target Tomcat host as a user with read access to the Tomcat installation. Invoke it with the Tomcat home path, for example: bash check_tomcat_106975.sh /opt/tomcat. It needs no root privileges unless your Tomcat directories are restricted.

#!/usr/bin/env bash
# check_tomcat_106975.sh
# Determine whether an Apache Tomcat 7 installation is vulnerable to Tenable plugin 106975
# (Tomcat 7.0.0 < 7.0.85; CVE-2018-1304 / CVE-2018-1305)
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

TARGET_PATH="${1:-}"

find_tomcat_home() {
  local candidates=()
  if [ -n "$TARGET_PATH" ]; then
    candidates+=("$TARGET_PATH")
  fi
  [ -n "${CATALINA_HOME:-}" ] && candidates+=("$CATALINA_HOME")
  [ -n "${CATALINA_BASE:-}" ] && candidates+=("$CATALINA_BASE")
  candidates+=(/opt/tomcat /usr/share/tomcat7 /var/lib/tomcat7 /usr/local/tomcat /opt/apache-tomcat*)

  local c
  for c in "${candidates[@]}"; do
    [ -e "$c" ] || continue
    if [ -f "$c/lib/catalina.jar" ] || [ -f "$c/RELEASE-NOTES" ] || [ -f "$c/RUNNING.txt" ]; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

extract_version() {
  local home="$1"
  local v=""

  # Try RELEASE-NOTES first
  if [ -f "$home/RELEASE-NOTES" ]; then
    v=$(grep -Eom1 'Apache Tomcat Version [0-9]+\.[0-9]+\.[0-9]+' "$home/RELEASE-NOTES" | awk '{print $4}')
    [ -n "$v" ] && { echo "$v"; return 0; }
  fi

  # Try RUNNING.txt
  if [ -f "$home/RUNNING.txt" ]; then
    v=$(grep -Eom1 'Apache Tomcat Version [0-9]+\.[0-9]+\.[0-9]+' "$home/RUNNING.txt" | awk '{print $4}')
    [ -n "$v" ] && { echo "$v"; return 0; }
  fi

  # Try manifest inside catalina.jar
  if [ -f "$home/lib/catalina.jar" ] && command -v unzip >/dev/null 2>&1; then
    v=$(unzip -p "$home/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null | sed -n 's/^Implementation-Version: //p' | head -n1 | tr -d '\r')
    [ -n "$v" ] && { echo "$v"; return 0; }
  fi

  return 1
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

HOME_DIR=$(find_tomcat_home) || {
  echo "UNKNOWN - could not locate Tomcat home; pass the install path explicitly"
  exit 2
}

VERSION=$(extract_version "$HOME_DIR") || {
  echo "UNKNOWN - could not determine Tomcat version from $HOME_DIR"
  exit 2
}

# Only assess Tomcat 7 for this specific Tenable finding.
case "$VERSION" in
  7.*)
    if version_lt "$VERSION" "7.0.85"; then
      echo "VULNERABLE - Apache Tomcat version $VERSION detected at $HOME_DIR (< 7.0.85)"
      exit 1
    else
      echo "PATCHED - Apache Tomcat version $VERSION detected at $HOME_DIR (>= 7.0.85)"
      exit 0
    fi
    ;;
  *)
    echo "UNKNOWN - Tomcat version $VERSION detected at $HOME_DIR; this script only evaluates the Tomcat 7.x condition behind plugin 106975"
    exit 2
    ;;
esac

Sources

1. Tenable Nessus Plugin 106975
2. Apache Tomcat 7 security advisories
3. NVD CVE-2018-1304
4. NVD CVE-2018-1305
5. CISA Known Exploited Vulnerabilities Catalog
6. Bitsight Groma: Apache Tomcat 7.0.84 Observation Footprint
7. Debian LTS DLA-1301-1 tomcat7 security update
8. Feedly CVE-2018-1304 intelligence card