vulnerability

F5: CVE-2015-5174: K30971148: Apache Tomcat 6.x vulnerability CVE-2015-5174

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Published

Mar 23, 2016

Added

Jun 17, 2026

Modified

Jun 17, 2026

Description

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (

Solution

f5-bigip-upgrade-latest

References

CVE-2015-5174
https://attackerkb.com/topics/CVE-2015-5174
https://my.f5.com/manage/s/article/K30971148
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2849
CWE-22
EUVD-EUVD-2022-2849

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report