Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Low severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Feb 21, 2024
Package
Affected versions
>= 7.0.0, < 7.0.4
>= 6.0.0, < 6.0.30
>= 5.5.0, < 5.5.30
Patched versions
7.0.4
6.0.30
5.5.30
Description
Published by the National Vulnerability Database
Feb 10, 2011
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 8, 2022
Last updated
Feb 21, 2024
Credits
-
oliverchang Analyst
-
sunSUNQ Analyst
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
References