Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Remediation

References

CVE-2015-5345

Related Vulnerabilities

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-6147)

PostgreSQL Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2018-1053)

Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-7679)

Apache Tomcat Uncontrolled Resource Consumption Vulnerability (CVE-2024-34750)

WordPress Plugin YITH Product Size Charts for WooCommerce Security Bypass (1.1.11)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2015-5345