vulnerability

SUSE: CVE-2025-46701: SUSE Linux Security Advisory

Try Surface Command
Back to search
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Jul 3, 2025
Added
Dec 5, 2025
Modified
Dec 5, 2025

Description

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.

Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

Solutions

suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webappssuse-upgrade-tomcat10suse-upgrade-tomcat10-admin-webappssuse-upgrade-tomcat10-docsuse-upgrade-tomcat10-docs-webappsuse-upgrade-tomcat10-el-5_0-apisuse-upgrade-tomcat10-embedsuse-upgrade-tomcat10-jsp-3_1-apisuse-upgrade-tomcat10-jsvcsuse-upgrade-tomcat10-libsuse-upgrade-tomcat10-servlet-6_0-apisuse-upgrade-tomcat10-webappssuse-upgrade-tomcat11suse-upgrade-tomcat11-admin-webappssuse-upgrade-tomcat11-docsuse-upgrade-tomcat11-docs-webappsuse-upgrade-tomcat11-el-6_0-apisuse-upgrade-tomcat11-embedsuse-upgrade-tomcat11-jsp-4_0-apisuse-upgrade-tomcat11-jsvcsuse-upgrade-tomcat11-libsuse-upgrade-tomcat11-servlet-6_1-apisuse-upgrade-tomcat11-webapps

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today