CVE-2015-5174

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-25 · updated 2026-10-14
Weakness: CWE-22

Description

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Affected products

Apache Tomcat: 6.0.0, 6.0.0-alpha, 6.0.1, 6.0.1-alpha, 6.0.2, 6.0.2-alpha (+84)
Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
Debian Linux: 7.0, 8.0

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
http://marc.info/?l=bugtraq&m=145974991225029&w=2
http://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html
http://rhn.redhat.com/errata/RHSA-2016-1435.html
http://rhn.redhat.com/errata/RHSA-2016-2045.html
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://seclists.org/bugtraq/2016/Feb/149
http://svn.apache.org/viewvc?view=revision&revision=1696281
http://svn.apache.org/viewvc?view=revision&revision=1696284

Get alerted when CVE-2015-5174 or the next vulnerability affects your stack