Apache Tomcat 7.0.x < 7.0.4 SecurityManager Local Security Bypass

According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.4. It is, therefore, affected by a security bypass vulnerability due to an error in the access restriction on a ‘ServletContext’ attribute which holds the location of the work directory in Tomcat’s SecurityManager. A malicious web application can modify the location of the working directory which then allows improper read and write access to arbitrary files and directories in the context of Tomcat.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application’s self-reported version number.