CVE:CVE-2019-12418
CNNVD:CNNVD-201912-924
Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 9.0.0.M1版本至9.0.28版本、8.5.0版本至8.5.47版本和7.0.0版本至7.0.97版本中存在安全漏洞。攻击者可通过实施中间人攻击利用该漏洞获取用户名和密码，访问JMX界面，控制Tomcat实例。
solution:Upgrade apache tomcat to a higher version than 7.0.97,8.5.47,9.0.28,and avoid the version [7.0.0,7.0.97],[8.5.0,8.5.47],[9.0.0,9.0.28]; Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0; Upgrade oracle workload_manager to a higher version than 12.2.0.1,18c,19c,and avoid the version 12.2.0.1,18c,19c; Upgrade canonical ubuntu_linux to a higher version than 16.04,and avoid the version 16.04; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade netapp oncommand_system_manager to a higher version than 3.1.3,and avoid the version [3.0.0,3.1.3]