NVD

Id
26413  
Name
CVE-2015-5174  
Description
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2015-5174  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
139634 26413 CVE-2015-5174 SUSE-SU-2016:0769  View
139635 26413 CVE-2015-5174 SUSE-SU-2016:0822  View
139636 26413 CVE-2015-5174 SUSE-SU-2016:0839  View
139637 26413 CVE-2015-5174 openSUSE-SU-2016:0865  View
139638 26413 CVE-2015-5174 HPSBUX03561  View
139639 26413 CVE-2015-5174 http://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html  View
139640 26413 CVE-2015-5174 RHSA-2016:1435  View
139641 26413 CVE-2015-5174 RHSA-2016:2045  View
139642 26413 CVE-2015-5174 20160222 [SECURITY] CVE-2015-5174 Apache Tomcat Limited Directory Traversal  View
139643 26413 CVE-2015-5174 http://svn.apache.org/viewvc?view=revision&revision=1696281  View
139644 26413 CVE-2015-5174 http://svn.apache.org/viewvc?view=revision&revision=1696284  View
139645 26413 CVE-2015-5174 http://svn.apache.org/viewvc?view=revision&revision=1700897  View
139646 26413 CVE-2015-5174 http://svn.apache.org/viewvc?view=revision&revision=1700898  View
139647 26413 CVE-2015-5174 http://svn.apache.org/viewvc?view=revision&revision=1700900  View
139648 26413 CVE-2015-5174 http://tomcat.apache.org/security-6.html  View
139649 26413 CVE-2015-5174 http://tomcat.apache.org/security-7.html  View
139650 26413 CVE-2015-5174 http://tomcat.apache.org/security-8.html  View
139651 26413 CVE-2015-5174 DSA-3530  View
139652 26413 CVE-2015-5174 DSA-3552  View
139653 26413 CVE-2015-5174 DSA-3609  View
139654 26413 CVE-2015-5174 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
139655 26413 CVE-2015-5174 83329  View
139656 26413 CVE-2015-5174 1035070  View
139657 26413 CVE-2015-5174 USN-3024-1  View
139658 26413 CVE-2015-5174 RHSA-2016:1432  View
139659 26413 CVE-2015-5174 RHSA-2016:1433  View
139660 26413 CVE-2015-5174 RHSA-2016:1434  View
139661 26413 CVE-2015-5174 https://bto.bluecoat.com/security-advisory/sa118  View
139662 26413 CVE-2015-5174 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964  View
139663 26413 CVE-2015-5174 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
139664 26413 CVE-2015-5174 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11570 JVNDB-2015-006890 Apache Tomcat の RequestUtil.java におけるディレクトリトラバーサルの脆弱性 Apache Tomcat の RequestUtil.java には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2015-5174 82399 CVE-2015-5174 26413 4 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006890.html 2015-08-17 2016-12-05 View