QwikSec

Security Database

CVE

CWE

Training

CVE-2015-5174

Published: Feb 25, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964

x_refsource_CONFIRM

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_GENTOO

http://svn.apache.org/viewvc?view=revision&revision=1700900

x_refsource_CONFIRM

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

x_refsource_CONFIRM

openSUSE-SU-2016:0865

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_UBUNTU

SUSE-SU-2016:0769

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_DEBIAN

http://tomcat.apache.org/security-7.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

http://svn.apache.org/viewvc?view=revision&revision=1696284

x_refsource_CONFIRM

http://tomcat.apache.org/security-8.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

http://svn.apache.org/viewvc?view=revision&revision=1700898

x_refsource_CONFIRM

vdb-entry

x_refsource_SECTRACK

https://bto.bluecoat.com/security-advisory/sa118

x_refsource_CONFIRM

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

https://security.netapp.com/advisory/ntap-20180531-0001/

x_refsource_CONFIRM

http://tomcat.apache.org/security-6.html

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

vendor-advisory

x_refsource_REDHAT

SUSE-SU-2016:0822

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_REDHAT

20160222 [SECURITY] CVE-2015-5174 Apache Tomcat Limited Directory Traversal

mailing-list

x_refsource_BUGTRAQ

vendor-advisory

x_refsource_DEBIAN

http://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html

x_refsource_MISC

SUSE-SU-2016:0839

vendor-advisory

x_refsource_SUSE

http://svn.apache.org/viewvc?view=revision&revision=1696281

x_refsource_CONFIRM

http://svn.apache.org/viewvc?view=revision&revision=1700897

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-users] 20200130 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context

mailing-list

x_refsource_MLIST

[tomcat-users] 20200130 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context

mailing-list

x_refsource_MLIST

[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context

mailing-list

x_refsource_MLIST

[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.