CVE-2015-5345
published 2016-02-25CVE-2015-5345: The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering…
PriorityP342medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EPSS
18.38%
96.9th percentile
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Affected
96 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_apache5.3MEDIUM
vendor_debian5.3LOW
vendor_redhat5.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2016-07-05·CVSS 4.3
CVE-2015-5174 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled pathnames used by web
applications in a getResource, getResourceAsStream, or getResourcePaths
call. A remote attacker could use this issue to possibly list a parent
directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and
Ubuntu 15.10. (CVE-2015-5174)
It was discovered that the Tomcat mapper component incorrectly handled
redirects. A remote attacker could use this issue to determine the
existence of a directory. This issue only affected Ubuntu 12.04 LTS,
Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-5345)
It was discovered that Tomcat incorrectly handled different session
settings when multiple versions of the same web application was
Red Hat
tomcat: directory disclosure
vendor_redhat·2016-02-22·CVSS 5.3
CVE-2015-5345 [MEDIUM] CWE-552 tomcat: directory disclosure
tomcat: directory disclosure
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.
Package: jbossweb (Red Hat JBoss BRMS 5) - Will not fix
Package: jbossweb (Red Hat JBoss Data Grid 6) - Affected
Package: jbossweb (Red H
Debian
CVE-2015-5345: tomcat9 - The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x ...
vendor_debian·2015·CVSS 5.3
CVE-2015-5345 [MEDIUM] CVE-2015-5345: tomcat9 - The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x ...
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Apache
Apache tomcat: CVE-2015-5345
vendor_apache·CVSS 5.3
CVE-2015-5345 [MEDIUM] Apache tomcat: CVE-2015-5345
Apache tomcat: CVE-2015-5345
When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory. The issue also occurred at the root of a web application in which case the presence of the web application was confirmed, even if a user did not have access. The solution was to implement the redirect in the DefaultServlet so that any security constraints and/or security enforcing Filters were processed before the redirect. The Tomcat team recognised that moving the redirect cou
OSV
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
osv·2022-05-14
CVE-2015-5345 [MEDIUM] Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
ghsa·2022-05-14
CVE-2015-5345 [MEDIUM] CWE-22 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
OSV
tomcat6, tomcat7 vulnerabilities
osv·2016-07-05·CVSS 4.3
CVE-2015-5174 [MEDIUM] tomcat6, tomcat7 vulnerabilities
tomcat6, tomcat7 vulnerabilities
It was discovered that Tomcat incorrectly handled pathnames used by web
applications in a getResource, getResourceAsStream, or getResourcePaths
call. A remote attacker could use this issue to possibly list a parent
directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and
Ubuntu 15.10. (CVE-2015-5174)
It was discovered that the Tomcat mapper component incorrectly handled
redirects. A remote attacker could use this issue to determine the
existence of a directory. This issue only affected Ubuntu 12.04 LTS,
Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-5345)
It was discovered that Tomcat incorrectly handled different session
settings when multiple versions of the same web application was deployed. A
remote attacker could possibly use this i
OSV
CVE-2015-5345: The Mapper component in Apache Tomcat 6
osv·2016-02-24·CVSS 5.3
CVE-2015-5345 [MEDIUM] CVE-2015-5345: The Mapper component in Apache Tomcat 6
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]
bugzilla·2016-07-01·CVSS 5.3
CVE-2015-5351 [MEDIUM] CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]
CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]
+++ This bug was initially created as a clone of Bug #1311102 +++
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also me
Bugzilla
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]
bugzilla·2016-02-23·CVSS 4.3
CVE-2015-5174 [MEDIUM] CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedp
Bugzilla
CVE-2015-5345 tomcat: directory disclosure
bugzilla·2016-02-23·CVSS 5.3
CVE-2015-5345 [MEDIUM] CVE-2015-5345 tomcat: directory disclosure
CVE-2015-5345 tomcat: directory disclosure
When accessing a directory protected by a security constraint with a URL
that did not end in a slash, Tomcat would redirect to the URL with the
trailing slash thereby confirming the presence of the directory before
processing the security constraint. It was therefore possible for a user
to determine if a directory existed or not, even if the user was not
permitted to view the directory. The issue also occurred at the root of
a web application in which case the presence of the web application was
confirmed, even if a user did not have access.
External references:
http://seclists.org/bugtraq/2016/Feb/146
Discussion:
Upstream patches:
Tomcat6:
http://svn.apache.org/viewvc?view=revision&revision=1715216
http://svn.apache.org/viewvc?view=revisio
Bugzilla
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all]
bugzilla·2016-02-23·CVSS 4.3
CVE-2015-5174 [MEDIUM] CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all]
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpk
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.htmlhttp://marc.info/?l=bugtraq&m=145974991225029&w=2http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1089.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2599.htmlhttp://seclists.org/bugtraq/2016/Feb/146http://seclists.org/fulldisclosure/2016/Feb/122http://svn.apache.org/viewvc?view=revision&revision=1715206http://svn.apache.org/viewvc?view=revision&revision=1715207http://svn.apache.org/viewvc?view=revision&revision=1715213http://svn.apache.org/viewvc?view=revision&revision=1715216http://svn.apache.org/viewvc?view=revision&revision=1716882http://svn.apache.org/viewvc?view=revision&revision=1716894http://svn.apache.org/viewvc?view=revision&revision=1717209http://svn.apache.org/viewvc?view=revision&revision=1717212http://svn.apache.org/viewvc?view=revision&revision=1717216http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://tomcat.apache.org/security-9.htmlhttp://www.debian.org/security/2016/dsa-3530http://www.debian.org/security/2016/dsa-3552http://www.debian.org/security/2016/dsa-3609http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.htmlhttp://www.securityfocus.com/bid/83328http://www.securitytracker.com/id/1035071http://www.ubuntu.com/usn/USN-3024-1https://access.redhat.com/errata/RHSA-2016:1087https://access.redhat.com/errata/RHSA-2016:1088https://bto.bluecoat.com/security-advisory/sa118https://bz.apache.org/bugzilla/show_bug.cgi?id=58765https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626https://kc.mcafee.com/corporate/index?page=content&id=SB10156https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://security.gentoo.org/glsa/201705-09https://security.netapp.com/advisory/ntap-20180531-0001/http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.htmlhttp://marc.info/?l=bugtraq&m=145974991225029&w=2http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1089.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2599.htmlhttp://seclists.org/bugtraq/2016/Feb/146http://seclists.org/fulldisclosure/2016/Feb/122http://svn.apache.org/viewvc?view=revision&revision=1715206http://svn.apache.org/viewvc?view=revision&revision=1715207http://svn.apache.org/viewvc?view=revision&revision=1715213http://svn.apache.org/viewvc?view=revision&revision=1715216http://svn.apache.org/viewvc?view=revision&revision=1716882http://svn.apache.org/viewvc?view=revision&revision=1716894http://svn.apache.org/viewvc?view=revision&revision=1717209http://svn.apache.org/viewvc?view=revision&revision=1717212http://svn.apache.org/viewvc?view=revision&revision=1717216http://tomcat.apache.org/security-6.htmlhttp://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://tomcat.apache.org/security-9.htmlhttp://www.debian.org/security/2016/dsa-3530http://www.debian.org/security/2016/dsa-3552http://www.debian.org/security/2016/dsa-3609http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.htmlhttp://www.securityfocus.com/bid/83328http://www.securitytracker.com/id/1035071http://www.ubuntu.com/usn/USN-3024-1https://access.redhat.com/errata/RHSA-2016:1087https://access.redhat.com/errata/RHSA-2016:1088https://bto.bluecoat.com/security-advisory/sa118https://bz.apache.org/bugzilla/show_bug.cgi?id=58765https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626https://kc.mcafee.com/corporate/index?page=content&id=SB10156https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
+ 2 more references
2016-02-25
Published