Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.108
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.108
Next non-vulnerable version 9.0.107
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-e7kd-kk57-mkd6
Aliases:
CVE-2020-8022
GHSA-gc58-v8h3-x2gr
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
8.0.53
Affected by 3 other vulnerabilities.
9.0.35
Affected by 16 other vulnerabilities.
VCID-kwab-3s4q-eka4
Aliases:
CVE-2021-30640
GHSA-36qh-35cm-5w2w
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
7.0.109
Affected by 1 other vulnerability.
8.5.66
Affected by 10 other vulnerabilities.
9.0.46
Affected by 10 other vulnerabilities.
10.0.6
Affected by 5 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-n3ab-nk7c-hqc9 The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. CVE-2021-25329
GHSA-jgwr-3qm3-26f3

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:38:50.768748+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.4.0
2026-04-16T21:27:25.872255+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2021-30640.yml 38.4.0
2026-04-11T22:53:56.135369+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.3.0
2026-04-11T22:40:22.181325+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2021-30640.yml 38.3.0
2026-04-02T23:03:09.906896+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.1.0
2026-04-02T22:50:52.633974+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2021-30640.yml 38.1.0
2026-04-02T16:56:15.637822+00:00 GHSA Importer Fixing VCID-n3ab-nk7c-hqc9 https://github.com/advisories/GHSA-jgwr-3qm3-26f3 38.1.0
2026-04-01T17:22:03.688679+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.0.0
2026-04-01T17:08:52.734808+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2021-30640.yml 38.0.0
2026-04-01T13:01:54.281935+00:00 GithubOSV Importer Fixing VCID-n3ab-nk7c-hqc9 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-jgwr-3qm3-26f3/GHSA-jgwr-3qm3-26f3.json 38.0.0