VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@9.0.23

Search for packages

Package details: pkg:maven/org.apache.tomcat/tomcat@9.0.23

Essentials
History (1)

purl	pkg:maven/org.apache.tomcat/tomcat@9.0.23
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	3.8

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-nmw2-9cf8-guhb Aliases: CVE-2025-49124	Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.	9.0.106 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.42 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.8 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-nmw2-9cf8-guhb
Aliases:
CVE-2025-49124

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

9.0.106
Affected by 1 other vulnerability.

10.1.42
Affected by 2 other vulnerabilities.

11.0.8
Affected by 2 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-06-20T13:41:07.254888+00:00	Apache Tomcat Importer	Affected by	VCID-nmw2-9cf8-guhb	https://tomcat.apache.org/security-9.html	36.1.3