NetSight
IP …
medium5.3

CVE-2015-5345

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering s…

Impact

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Affected products

VendorProductAffected versions
DebianDebian Linux
Versions 7.0, 8.0
ApacheTomcat
Versions 6.0.0, 6.0.1, 6.0.2, 6.0.4, 6.0.10, 6.0.11
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04

Weakness classification

CWE-22

References