REDHAT-BUG-2373018: Low severity Apache Tomcat vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2373018?
The REDHAT-BUG-2373018 vulnerability is classified as high severity due to its potential for authentication bypass.
How do I fix REDHAT-BUG-2373018?
To fix REDHAT-BUG-2373018, ensure that PreResources and PostResources are mounted at the root of the web application to prevent unintended access.
What software is affected by REDHAT-BUG-2373018?
The affected software for REDHAT-BUG-2373018 is Apache Tomcat.
Can REDHAT-BUG-2373018 be exploited remotely?
Yes, REDHAT-BUG-2373018 can be exploited remotely if proper access controls are not in place.
What are the implications of REDHAT-BUG-2373018?
The implications of REDHAT-BUG-2373018 include unauthorized access to sensitive resources, potentially leading to data exposure.