Description

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Remediation

References

CVE-2017-12616

Related Vulnerabilities

Microsoft SQL Server Remote Code Execution Vulnerability (CVE-2019-1068)

WordPress Plugin Secure HTML5 Video Player Cross-Site Scripting (3.3)

WordPress Plugin Elementor Website Builder Unspecified Vulnerability (3.0.15)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-6939)

Jenkins Missing Release of Resource after Effective Lifetime Vulnerability (CVE-2018-1999043)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2017-12616