The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | apache-tomcat-upgrade-6_0_45apache-tomcat-upgrade-7_0_68apache-tomcat-upgrade-8_0_30apache-tomcat-upgrade-9_0_0apache-tomcat-6_0apache-tomcat-7_0apache-tomcat-8_0apache-tomcat-9_0apache-tomcat-upgrade-latest | Feb 25, 2016 | Feb 25, 2016 | |
| Centos_linux | — | centos-upgrade-tomcat6centos-upgrade-tomcat6-admin-webappscentos-upgrade-tomcat6-docs-webappcentos-upgrade-tomcat6-el-2-1-apicentos-upgrade-tomcat6-javadoccentos-upgrade-tomcat6-jsp-2-1-apicentos-upgrade-tomcat6-libcentos-upgrade-tomcat6-servlet-2-5-apicentos-upgrade-tomcat6-webapps | Oct 21, 2016 | Feb 24, 2016 |
| Debian | debian-upgrade-tomcat6debian-upgrade-tomcat7 | Mar 28, 2016 | Feb 24, 2016 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Mar 5, 2018 | |
| Freebsd | freebsd-upgrade-package-tomcatfreebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat8 | Dec 10, 2025 | Feb 28, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-tomcat | Oct 30, 2017 | Feb 24, 2016 | |
| Hpux | — | hpux-update-hpuxws22tomcat-hpuxws22tomcat-tomcathpux-update-hpuxws22tomcat-tomcathpux-update-hpuxws22tomcat-tomcat2 | Aug 11, 2017 | Feb 24, 2016 |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-tomcathuawei-euleros-2_0_sp1-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp1-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp1-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp1-upgrade-tomcat-libhuawei-euleros-2_0_sp1-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp1-upgrade-tomcat-webapps | Nov 30, 2017 | Feb 24, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-6-0-45-0-175-3-6-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-8-0-32-0-175-3-6-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-0-32-0-175-3-6-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-0-32-0-175-3-6-0-4-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-tomcat-examples-6-0-45-0-175-3-6-0-4-0 | May 29, 2017 | Feb 24, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat6oracle-linux-upgrade-tomcat6-admin-webappsoracle-linux-upgrade-tomcat6-docs-webapporacle-linux-upgrade-tomcat6-el-2-1-apioracle-linux-upgrade-tomcat6-javadocoracle-linux-upgrade-tomcat6-jsp-2-1-apioracle-linux-upgrade-tomcat6-liboracle-linux-upgrade-tomcat6-servlet-2-5-apioracle-linux-upgrade-tomcat6-webappsoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-2-2-apioracle-linux-upgrade-tomcat-javadocoracle-linux-upgrade-tomcat-jsp-2-2-apioracle-linux-upgrade-tomcat-jsvcoracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-3-0-apioracle-linux-upgrade-tomcat-webapps | Oct 11, 2016 | Feb 22, 2016 |
| Redhat_linux | — | redhat-upgrade-tomcatredhat-upgrade-tomcat-admin-webappsredhat-upgrade-tomcat-docs-webappredhat-upgrade-tomcat-el-2-2-apiredhat-upgrade-tomcat-javadocredhat-upgrade-tomcat-jsp-2-2-apiredhat-upgrade-tomcat-jsvcredhat-upgrade-tomcat-libredhat-upgrade-tomcat-servlet-3-0-apiredhat-upgrade-tomcat-webappsredhat-upgrade-tomcat6redhat-upgrade-tomcat6-admin-webappsredhat-upgrade-tomcat6-docs-webappredhat-upgrade-tomcat6-el-2-1-apiredhat-upgrade-tomcat6-javadocredhat-upgrade-tomcat6-jsp-2-1-apiredhat-upgrade-tomcat6-libredhat-upgrade-tomcat6-servlet-2-5-apiredhat-upgrade-tomcat6-webapps | Oct 21, 2016 | Feb 24, 2016 |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-2_2-apisuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_2-apisuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-3_0-apisuse-upgrade-tomcat-servlet-3_1-apisuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webappssuse-upgrade-tomcat6suse-upgrade-tomcat6-admin-webappssuse-upgrade-tomcat6-docs-webappsuse-upgrade-tomcat6-javadocsuse-upgrade-tomcat6-jsp-2_1-apisuse-upgrade-tomcat6-libsuse-upgrade-tomcat6-servlet-2_5-apisuse-upgrade-tomcat6-webapps | Mar 22, 2016 | Feb 24, 2016 |
| Ubuntu | ubuntu-upgrade-libtomcat6-javaubuntu-upgrade-libtomcat7-java | Jul 5, 2016 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub