VulnerableCode Advisory Details - GHSA-rh8q-vjgf-gf74

System	Score	Found at
cvssv3	5.3	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rh8q-vjgf-gf74/GHSA-rh8q-vjgf-gf74.json
generic_textual	MODERATE

System

Score

Found at

cvssv3

5.3

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rh8q-vjgf-gf74/GHSA-rh8q-vjgf-gf74.json

generic_textual

MODERATE

Reference id

Reference type

URL

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html

http://marc.info/?l=bugtraq&m=145974991225029&w=2

http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html

http://rhn.redhat.com/errata/RHSA-2016-2599.html

https://bto.bluecoat.com/security-advisory/sa118

https://bz.apache.org/bugzilla/show_bug.cgi?id=58765

http://seclists.org/bugtraq/2016/Feb/146

http://seclists.org/fulldisclosure/2016/Feb/122

https://github.com/apache/tomcat

https://github.com/apache/tomcat80/commit/2b643a4e36d318d55ec57fee57610671656d23c0

https://github.com/apache/tomcat80/commit/c15c2aba8eb42425f9ebcfcaef579dada38ad3a2

https://github.com/apache/tomcat/commit/127d8ea86d245846f0472865f0eb1eb111955e71

https://github.com/apache/tomcat/commit/58c09b6217c546e1a251a82da227018f05277228

https://github.com/apache/tomcat/commit/66daa4adc14b3e939659879153c0a579fdfcb099

https://github.com/apache/tomcat/commit/7288bc70a14edcfeff0a96e333a858be374cfc64

https://github.com/apache/tomcat/commit/816552abf6735fa37dfd37c8a7bfbdbd045477e0

https://github.com/apache/tomcat/commit/8437193708e4bf6b2861a7953dc472f9dad49111

https://github.com/apache/tomcat/commit/89cd0cf33a99dbbcf5c69050a83b6876e39269d7

https://github.com/apache/tomcat/commit/a273b5f45cb46a273d06510a689fc314155a952d

https://github.com/apache/tomcat/commit/c584c7c4ab0686e4125eefcd0afb32fb8269da3d

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626

https://kc.mcafee.com/corporate/index?page=content&id=SB10156

https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E

https://security.gentoo.org/glsa/201705-09

https://security.netapp.com/advisory/ntap-20180531-0001

http://svn.apache.org/viewvc?view=revision&revision=1715206

http://svn.apache.org/viewvc?view=revision&revision=1715207

http://svn.apache.org/viewvc?view=revision&revision=1715213

http://svn.apache.org/viewvc?view=revision&revision=1715216

http://svn.apache.org/viewvc?view=revision&revision=1716882

http://svn.apache.org/viewvc?view=revision&revision=1716894

http://svn.apache.org/viewvc?view=revision&revision=1717209

http://svn.apache.org/viewvc?view=revision&revision=1717212

http://svn.apache.org/viewvc?view=revision&revision=1717216

https://web.archive.org/web/20160321235514/http://www.securitytracker.com/id/1035071

https://web.archive.org/web/20160804024910/http://www.securityfocus.com/bid/83328

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-7.html

http://tomcat.apache.org/security-8.html

http://tomcat.apache.org/security-9.html

http://www.debian.org/security/2016/dsa-3530

http://www.debian.org/security/2016/dsa-3552

http://www.debian.org/security/2016/dsa-3609

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html

http://www.ubuntu.com/usn/USN-3024-1

cpujul2018-4258247.html

Other

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CVE-2015-5345

https://nvd.nist.gov/vuln/detail/CVE-2015-5345

r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Mailing List

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

RHSA-2016:1087

https://access.redhat.com/errata/RHSA-2016:1087

RHSA-2016:1088

https://access.redhat.com/errata/RHSA-2016:1088

RHSA-2016-1089.html

http://rhn.redhat.com/errata/RHSA-2016-1089.html

RHSA-2016-2045.html

http://rhn.redhat.com/errata/RHSA-2016-2045.html

Patch URL
There are no known patches.

Patch URL

There are no known patches.

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rh8q-vjgf-gf74/GHSA-rh8q-vjgf-gf74.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Advisory ID	github_osv/GHSA-rh8q-vjgf-gf74
Aliases	CVE-2015-5345
Summary	Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Status	Published
Exploitability	0.5
Weighted Severity	4.8
Risk	2.4
Affected and Fixed Packages	Package Details
Introduced and Fixed Package Commit Patches	Package Commit Patches Details