GHSA-fj6c-prgj-gr3r Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

• Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.4 → fixed in 7.0.4 • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.30 → fixed in 6.0.30 • Maven org.apache.tomcat:tomcat: >= 5.5.0, < 5.5.30 → fixed in 5.5.30

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.