Search for vulnerabilities
Vulnerability details: VCID-nmw2-9cf8-guhb
Vulnerability ID VCID-nmw2-9cf8-guhb
Aliases CVE-2025-49124
Summary Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 7.6
Risk 3.8
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-426 Untrusted Search Path
System Score Found at
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2025-49124
apache_tomcat Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49124
cvssv3.1 7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.4 https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
ssvc Track https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-49124
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823
https://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7
https://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49
https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
http://www.openwall.com/lists/oss-security/2025/06/16/3
CVE-2025-49124 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49124
CVE-2025-49124 https://nvd.nist.gov/vuln/detail/CVE-2025-49124
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-17T14:03:41Z/ Found at https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
Exploit Prediction Scoring System (EPSS)
Percentile 0.0229
EPSS Score 0.00016
Published At June 25, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-06-20T13:41:07.010633+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-11.html 36.1.3