CVE-2015-5345: Path Traversal
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Other sources
When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was therefore possible for a user to determine if a directory existed or not, even if the user was not permitted to view the directory. The issue also occurred at the root of a web application in which case the presence of the web application was confirmed, even if a user did not have access.
External references:
http://seclists.org/bugtraq/2016/Feb/146
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5345?
CVE-2015-5345 is categorized as a medium severity vulnerability.
How do I fix CVE-2015-5345?
To fix CVE-2015-5345, upgrade Apache Tomcat to version 6.0.45, 7.0.68, 8.0.30, or later versions.
What systems are affected by CVE-2015-5345?
CVE-2015-5345 affects Apache Tomcat versions prior to 6.0.45, 7.0.68, 8.0.30, and 9.0.0.M2.
What is the impact of CVE-2015-5345?
CVE-2015-5345 allows remote attackers to enumerate existing directories on the web server.
Is CVE-2015-5345 exploitable remotely?
Yes, CVE-2015-5345 can be exploited remotely by sending specially crafted requests to the server.