CVEvulnerability

CVE-2015-5174

4.3 MEDIUM Published 2016-02-25 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2016-02-25
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Affected configurations

• debian debian linux 7.0 • debian debian linux 8.0 • apache tomcat 6.0.0 • apache tomcat 6.0.1 • apache tomcat 6.0.2 • apache tomcat 6.0.4 • apache tomcat 6.0.10 • apache tomcat 6.0.11 • apache tomcat 6.0.13 • apache tomcat 6.0.14 • apache tomcat 6.0.16 • apache tomcat 6.0.18 • apache tomcat 6.0.20 • apache tomcat 6.0.24 • apache tomcat 6.0.26 • apache tomcat 6.0.28 • apache tomcat 6.0.29 • apache tomcat 6.0.30 • apache tomcat 6.0.32 • apache tomcat 6.0.33 • apache tomcat 6.0.35 • apache tomcat 6.0.36 • apache tomcat 6.0.37 • apache tomcat 6.0.39 • apache tomcat 6.0.41 • apache tomcat 6.0.43 • apache tomcat 6.0.44 • apache tomcat 7.0.0 • apache tomcat 7.0.2 • apache tomcat 7.0.4 • apache tomcat 7.0.5 • apache tomcat 7.0.6 • apache tomcat 7.0.10 • apache tomcat 7.0.11 • apache tomcat 7.0.12 • apache tomcat 7.0.14 • apache tomcat 7.0.16 • apache tomcat 7.0.19 • apache tomcat 7.0.20 • apache tomcat 7.0.21 • apache tomcat 7.0.22 • apache tomcat 7.0.23 • apache tomcat 7.0.25 • apache tomcat 7.0.26 • apache tomcat 7.0.27 • apache tomcat 7.0.28 • apache tomcat 7.0.29 • apache tomcat 7.0.30 • apache tomcat 7.0.32 • apache tomcat 7.0.33 • apache tomcat 7.0.34 • apache tomcat 7.0.35 • apache tomcat 7.0.37 • apache tomcat 7.0.39 • apache tomcat 7.0.40 • apache tomcat 7.0.41 • apache tomcat 7.0.42 • apache tomcat 7.0.47 • apache tomcat 7.0.50 • apache tomcat 7.0.52 … and 28 more

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References