CVE-2017-7675 — Path Traversal in Software Foundation Apache Tomcat

CWE-22 — Path TraversalCWE-358 — Improperly Implemented Security Check for Standard8 documents8 sources
Severity
7.5HIGHNVD
EPSS
5.6%
top 9.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache TomcatApache Tomcat
Timeline
PublishedAug 11
Latest updateMay 14

Description

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/tomcat17 versions+16
▶CVEListV5apache_software_foundation/apache_tomcat8.5.0 to 8.5.15, 9.0.0.M1 to 9.0.0.M21+1

🔴Vulnerability Details

3
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat↗2022-05-14
▶
OSV
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat↗2022-05-14
▶
CVEList
CVE-2017-7675: The HTTP/2 implementation in Apache Tomcat 9↗2017-08-11
▶

📋Vendor Advisories

3
Red Hat
tomcat: Security Constraint Bypass↗2017-08-10
▶
Debian
CVE-2017-7675: tomcat9 - The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8....↗2017
▶
Apache
Apache tomcat: CVE-2017-7675↗
▶

💬Community

1
Bugzilla
CVE-2017-7675 tomcat: Security Constraint Bypass↗2017-08-11
▶
CVE-2017-7675 — Path Traversal | cvebase