CVE-2013-4590: Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomca...

Security readout for executives and security teams

This issue affected older Apache Tomcat releases. If an untrusted web application supplied specific XML files with external entity declarations, Tomcat could expose internal information. The strongest business concern is shared or multi-tenant Tomcat hosting, where applications from less-trusted parties run on the same server. Exposure is most likely in legacy Tomcat 6, 7, or early 8 deployments, especially where third-party or tenant-controlled web applications can be deployed. Products bundling Tomcat may also inherit exposure through vendor-specific packages. Prioritize remediation for internet-facing, shared-hosting, or third-party application environments running old Tomcat. Single-tenant systems with only trusted application deployment are lower urgency but should still be upgraded because affected versions are obsolete. Mitigation focus: Upgrade Tomcat to 6.0.39, 7.0.50, 8.0.0-RC10, or later supported releases.; Apply vendor updates for products that bundle Apache Tomcat.; Do not allow untrusted parties to deploy web applications on shared Tomcat instances..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.