CVE-2015-5345 | BDVDB-2026-74568 Detail
Description#
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
- http://svn.apache.org/viewvc?view=revision&revision=1715216
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://security.gentoo.org/glsa/201705-09
- https://kc.mcafee.com/corporate/index?page=content&id=SB10156
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
- http://tomcat.apache.org/security-9.html
- http://svn.apache.org/viewvc?view=revision&revision=1715213
- http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
- http://www.ubuntu.com/usn/USN-3024-1
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
- http://rhn.redhat.com/errata/RHSA-2016-2045.html
- http://www.debian.org/security/2016/dsa-3530
- http://tomcat.apache.org/security-7.html
Show all 40
- http://svn.apache.org/viewvc?view=revision&revision=1715206
- http://marc.info/?l=bugtraq&m=145974991225029&w=2
- http://rhn.redhat.com/errata/RHSA-2016-1089.html
- http://tomcat.apache.org/security-8.html
- http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
- https://access.redhat.com/errata/RHSA-2016:1087
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1035071
- https://bto.bluecoat.com/security-advisory/sa118
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
- https://access.redhat.com/errata/RHSA-2016:1088
- http://svn.apache.org/viewvc?view=revision&revision=1717212
- https://security.netapp.com/advisory/ntap-20180531-0001/
- http://tomcat.apache.org/security-6.html
- http://seclists.org/bugtraq/2016/Feb/146
- http://svn.apache.org/viewvc?view=revision&revision=1716894
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
- http://svn.apache.org/viewvc?view=revision&revision=1717209
- http://www.securityfocus.com/bid/83328
- http://svn.apache.org/viewvc?view=revision&revision=1715207
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://www.debian.org/security/2016/dsa-3609
- http://svn.apache.org/viewvc?view=revision&revision=1717216
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.