REDHAT-BUG-2373018: Low severity Apache Tomcat vulnerability

Published Jun 16, 2025
·
Updated

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Affected Software

1 affected component
Apache Tomcat>=undefined

Event History

Jun 16, 2025
Data Sourced
via Red Hat·03:01 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2373018?

The REDHAT-BUG-2373018 vulnerability is classified as high severity due to its potential for authentication bypass.

2

How do I fix REDHAT-BUG-2373018?

To fix REDHAT-BUG-2373018, ensure that PreResources and PostResources are mounted at the root of the web application to prevent unintended access.

3

What software is affected by REDHAT-BUG-2373018?

The affected software for REDHAT-BUG-2373018 is Apache Tomcat.

4

Can REDHAT-BUG-2373018 be exploited remotely?

Yes, REDHAT-BUG-2373018 can be exploited remotely if proper access controls are not in place.

5

What are the implications of REDHAT-BUG-2373018?

The implications of REDHAT-BUG-2373018 include unauthorized access to sensitive resources, potentially leading to data exposure.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203