Tomcat8 / CVE-2020-1938 / CVE-2019-17569

Vulnerability Tests
6

I did a short cross-check against such a 8.5.50 installation and this works as expected from NASL side:

Detected Apache Tomcat

Version:       8.5.50
Location:      8081/tcp
CPE:           cpe:/a:apache:tomcat:8.5.50

Concluded from version/product identification result:
Apache Tomcat Version 8.5.50

Concluded from version/product identification location:
http://<redacted>:8081/RELEASE-NOTES.txt

Installed version: 8.5.50
Fixed version:     8.5.51
Installation
path / port:       8081/tcp

A few things to check:

  1. Any issues / problems from GVM side (e.g. outdated versions of components, other problems with the feed sync, …)
  2. Has the filter really be adjusted to show results for VTs with a QoD < 70%
  3. The detection also seems to not happen via a SSH login, you can cross-check the requirements following Hint: Verify target configuration / access for authenticated (LSC) scans