CVE-2017-12616 — Sensitive Information Exposure in Software Foundation Apache Tomcat

CWE-200 — Sensitive Information Exposure11 documents7 sources
Severity
7.5HIGHNVD
EPSS
91.4%
top 0.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache TomcatApache Tomcat
Timeline
PublishedSep 19
Latest updateFeb 21

Description

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/tomcat78 versions+77
▶CVEListV5apache_software_foundation/apache_tomcat7.0.0 to 7.0.80

🔴Vulnerability Details

5
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat↗2022-05-14
▶
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat↗2022-05-14
▶
OSV
tomcat7, tomcat8 vulnerabilities↗2018-05-30
▶
OSV
CVE-2017-12616: When using a VirtualDirContext with Apache Tomcat 7↗2017-09-19
▶
CVEList
CVE-2017-12616: When using a VirtualDirContext with Apache Tomcat 7↗2017-09-19
▶

📋Vendor Advisories

3
Ubuntu
tomcat7 vulnerabilities↗2025-02-21
▶
Ubuntu
Tomcat vulnerabilities↗2018-05-30
▶
Red Hat
tomcat: Information Disclosure when using VirtualDirContext↗2017-09-19
▶

💬Community

2
Bugzilla
CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext [epel-6]↗2017-09-19
▶
Bugzilla
CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext↗2017-09-19
▶
CVE-2017-12616 — Sensitive Information Exposure | cvebase