CVE-2017-7675: Path Traversal
Published Aug 11, 2017
·Updated
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Affected Software
60 affected componentsFixes available
maven/org.apache.tomcat:tomcat>=8.5.0<=8.5.15
8.5.16
maven/org.apache.tomcat:tomcat>=9.0.0.M1<=9.0.0.M21
9.0.0.M22
Apache Tomcat=8.5.0
Apache Tomcat=8.5.1
Apache Tomcat=8.5.2
Apache Tomcat=8.5.3
Apache Tomcat=8.5.4
Apache Tomcat=8.5.5
Apache Tomcat=8.5.6
Apache Tomcat=8.5.7
Apache Tomcat=8.5.8
Apache Tomcat=8.5.9
Apache Tomcat=8.5.10
Apache Tomcat=8.5.11
Apache Tomcat=8.5.12
Apache Tomcat=8.5.13
Apache Tomcat=8.5.14
Apache Tomcat=8.5.15
Apache Tomcat=9.0.0-milestone1
Apache Tomcat=9.0.0-milestone10
Apache Tomcat=9.0.0-milestone11
Apache Tomcat=9.0.0-milestone12
Apache Tomcat=9.0.0-milestone13
Apache Tomcat=9.0.0-milestone14
Apache Tomcat=9.0.0-milestone15
Apache Tomcat=9.0.0-milestone16
Apache Tomcat=9.0.0-milestone17
Apache Tomcat=9.0.0-milestone18
Apache Tomcat=9.0.0-milestone19
Apache Tomcat=9.0.0-milestone2
Apache Tomcat=9.0.0-milestone20
Apache Tomcat=9.0.0-milestone21
Apache Tomcat=9.0.0-milestone3
Apache Tomcat=9.0.0-milestone4
Apache Tomcat=9.0.0-milestone5
Apache Tomcat=9.0.0-milestone6
Apache Tomcat=9.0.0-milestone7
Apache Tomcat=9.0.0-milestone8
Apache Tomcat=9.0.0-milestone9
Apache Tomcat=9.0.0-m1
Apache Tomcat=9.0.0-m10
Apache Tomcat=9.0.0-m11
Apache Tomcat=9.0.0-m12
Apache Tomcat=9.0.0-m13
Apache Tomcat=9.0.0-m14
Apache Tomcat=9.0.0-m15
Apache Tomcat=9.0.0-m16
Apache Tomcat=9.0.0-m17
Apache Tomcat=9.0.0-m18
Apache Tomcat=9.0.0-m19
Apache Tomcat=9.0.0-m2
Apache Tomcat=9.0.0-m20
Apache Tomcat=9.0.0-m21
Apache Tomcat=9.0.0-m3
Apache Tomcat=9.0.0-m4
Apache Tomcat=9.0.0-m5
Apache Tomcat=9.0.0-m6
Apache Tomcat=9.0.0-m7
Apache Tomcat=9.0.0-m8
Apache Tomcat=9.0.0-m9
Event History
Aug 11, 2017
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
DescriptionWeakness
May 14, 2022
Advisory Published
12:58 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-7675?
CVE-2017-7675 has been assigned a severity level of medium due to its potential for directory traversal attacks.
2
How do I fix CVE-2017-7675?
To fix CVE-2017-7675, upgrade to Apache Tomcat version 8.5.16 or 9.0.0.M22 or later.
3
What versions of Apache Tomcat are affected by CVE-2017-7675?
CVE-2017-7675 affects Apache Tomcat versions from 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21.
4
What type of vulnerability is CVE-2017-7675?
CVE-2017-7675 is a directory traversal vulnerability that allows bypassing security constraints.
5
Can CVE-2017-7675 be exploited remotely?
Yes, CVE-2017-7675 can be exploited remotely through specially crafted URLs.