Advisory details:
github_osv / GHSA-42wg-hm62-jcwg
| Advisory ID | github_osv/GHSA-42wg-hm62-jcwg |
| Aliases |
CVE-2025-49124
|
| Summary | Apache Tomcat installer for Windows has an untrusted search path vulnerability Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.3 |
| Risk | 2.1 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-426 | Untrusted Search Path |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 4.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-42wg-hm62-jcwg/GHSA-42wg-hm62-jcwg.json |
| generic_textual | MODERATE |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-17T14:03:41Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/49xxx/CVE-2025-49124.json
Source Advisory: vulnrichment/CVE-2025-49124
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]