CVE-2017-7674EPSS p94.7%

CVE-2017-7674CVE-2017-7674

apache / tomcat

Description

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Scoring

CVSS 4.3 ()
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS8.04% probability of exploitation · percentile 94.7% · 2026-10-17T12:00:28Z
Last modified2026-10-15
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.