Published: 25/02/2016 Updated: 07/11/2023

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x prior to 6.0.45, 7.x prior to 7.0.65, and 8.x prior to 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
apache tomcat 7.0.2
apache tomcat 6.0.33
apache tomcat 6.0.0
apache tomcat 6.0.39
apache tomcat 7.0.12
apache tomcat 7.0.62
apache tomcat 8.0.17
apache tomcat 7.0.53
apache tomcat 6.0.4
apache tomcat 7.0.20
apache tomcat 6.0.11
apache tomcat 7.0.34
apache tomcat 8.0.26
apache tomcat 7.0.55
apache tomcat 7.0.4
apache tomcat 7.0.63
apache tomcat 8.0.20
apache tomcat 7.0.22
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.28
apache tomcat 8.0.1
apache tomcat 8.0.0
apache tomcat 7.0.59
apache tomcat 6.0.44
apache tomcat 7.0.50
apache tomcat 7.0.6
apache tomcat 6.0.20
apache tomcat 8.0.12
apache tomcat 7.0.14
apache tomcat 6.0.10
apache tomcat 8.0.15
apache tomcat 6.0.29
apache tomcat 7.0.11
apache tomcat 7.0.23
apache tomcat 7.0.0
apache tomcat 6.0.1
apache tomcat 6.0.24
apache tomcat 8.0.22
apache tomcat 6.0.37
apache tomcat 7.0.52
apache tomcat 7.0.42
apache tomcat 6.0.32
apache tomcat 6.0.28
apache tomcat 7.0.37
apache tomcat 7.0.29
apache tomcat 8.0.11
apache tomcat 8.0.24
apache tomcat 8.0.23
apache tomcat 7.0.47
apache tomcat 7.0.5
apache tomcat 8.0.21
apache tomcat 6.0.14
apache tomcat 7.0.41
apache tomcat 7.0.30
apache tomcat 7.0.19
apache tomcat 7.0.16
apache tomcat 6.0.41
apache tomcat 7.0.10
apache tomcat 8.0.18
apache tomcat 7.0.25
apache tomcat 7.0.54
apache tomcat 7.0.35
apache tomcat 7.0.61
apache tomcat 6.0.18
apache tomcat 7.0.57
apache tomcat 6.0.2
apache tomcat 8.0.14
apache tomcat 7.0.32
apache tomcat 6.0.43
apache tomcat 7.0.21
apache tomcat 7.0.27
apache tomcat 7.0.40
apache tomcat 6.0.30
apache tomcat 6.0.13
apache tomcat 7.0.56
apache tomcat 6.0.26
apache tomcat 7.0.64
apache tomcat 6.0.35
apache tomcat 6.0.16
apache tomcat 6.0.36
apache tomcat 7.0.33
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04

Several security issues were fixed in Tomcat ...

Synopsis Important: tomcat6 security and bug fix update Type/Severity Security Advisory: Important Topic An update for tomcat6 is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Synopsis Moderate: Red Hat JBoss Web Server 302 security update Type/Severity Security Advisory: Moderate Topic Updated Red Hat JBoss Web Server 302 packages are now available for RedHat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerabi ...

Synopsis Moderate: Red Hat JBoss Web Server 302 security update Type/Severity Security Advisory: Moderate Topic Updated Red Hat JBoss Web Server 302 packages are now available for RedHat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerabi ...

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections, bypass of the SecurityManager or denial of service For the stable distribution (jessie), these problems have been fixed in version 8014-1+deb8u2 For the unstable distribution (s ...

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager For the oldstable distribution (wheezy), these problems have been fixed in version 7028-4+deb7u4 This update also fixes CVE-2014-0119 and CVE-20 ...

A directory traversal flaw was found in Tomcat's RequestUtiljava A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call ...

A directory traversal vulnerability in RequestUtiljava was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a / (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call (CVE-2015-5174) The Mapper compo ...

Get Started

CVE-2015-5174

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect