GitHub Advisoryadvisory · Maven

GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

MEDIUM Published 2022-05-14 Modified 2025-08-28 Official page ↗
Aliases
CVE-2015-5345
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-07-06

Affected packages

• Maven org.apache.tomcat:tomcat: >= 9.0.0.M1, < 9.0.0.M2 → fixed in 9.0.0.M2 • Maven org.apache.tomcat:tomcat: >= 8.0.0-RC1, < 8.0.30 → fixed in 8.0.30 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.68 → fixed in 7.0.68 • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.45 → fixed in 6.0.45

Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Related

Alias · CVE (1)

  • CVE-2015-5345 The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References