When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

References

bugzilla.redhat.com/show_bug.cgi?id=1493222

tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81

prion 1

debiancve 1

veracode 1

osv 4

archlinux 1

checkpoint_advisories 1

openvas 7

nessus 8

f5 1

dsquare 1

debian 2

github 1

cve 1

cisa 1

myhack58 1

kaspersky 1

ubuntucve 1

amazon 2

tomcat 1

seebug 2

mageia 1

ibm 7

suse 1

ubuntu 1

redhat 2

rosalinux 1

symantec 1

prion

Design/Logic Flaw

2017-09-19 13:29:00

debiancve

CVE-2017-12616

2017-09-19 13:29:00

veracode

Information Disclosure

2017-09-20 02:23:33

osv

tomcat7 - security update

2017-09-24 00:00:00

CVE-2017-12616

2017-09-19 13:29:00

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

2022-05-14 01:10:16

archlinux

[ASA-201709-17] tomcat7: information disclosure

2017-09-19 00:00:00

checkpoint_advisories

Apache Tomcat VirtualDirContext Information Disclosure (CVE-2017-12616)

2017-10-02 00:00:00

openvas

Apache Tomcat 'VirtualDirContext' Information Disclosure Vulnerability - Windows

2017-09-25 00:00:00

Debian: Security Advisory (DLA-1108-1)

2018-02-06 00:00:00

Apache Tomcat 'VirtualDirContext' Information Disclosure Vulnerability - Linux

2017-09-25 00:00:00

nessus

Debian DLA-1108-1 : tomcat7 security update

2017-09-25 00:00:00

Amazon Linux 2 : tomcat (ALAS-2023-2020)

2023-05-02 00:00:00

Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities

2018-11-05 00:00:00

K24335161 : Apache Tomcat vulnerability CVE-2017-12616

2017-09-28 00:00:00

dsquare

Apache Tomcat VirtualDirContext Class File Handling Remote JSP Source Code Disclosure

2018-03-09 00:00:00

debian

[SECURITY] [DLA 1108-1] tomcat7 security update

2017-09-24 16:53:09

[SECURITY] [DLA 1400-1] tomcat7 security update

2018-06-27 20:56:21

github

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

2022-05-14 01:10:16

cve

CVE-2017-12616

2017-09-19 13:29:00

cisa

Apache Releases Security Updates for Apache Tomcat

2017-09-19 00:00:00

myhack58

Tomcat remote code execution vulnerability flaws bug research CVE-2017-12615 and patch Bypass-vulnerability warning-the black bar safety net

2017-09-20 00:00:00

kaspersky

KLA11106 Multiple vulnerabilities in Apache Tomcat

2017-09-19 00:00:00

ubuntucve

CVE-2017-12616

2017-09-19 00:00:00

amazon

Important: tomcat

2023-04-27 18:36:00

Important: tomcat7

2023-04-27 16:19:00

tomcat

Fixed in Apache Tomcat 7.0.81

2017-08-16 00:00:00

seebug

Tomcat code execution vulnerability(CVE-2017-12615)

2017-09-20 00:00:00

Tomcat information disclosure Vulnerability(CVE-2017-12616 )analysis

2017-09-21 00:00:00

mageia

Updated tomcat packages fix security vulnerability

2017-09-21 16:43:32

ibm

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology

2021-04-28 18:35:50

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

suse

Security update for tomcat (important)

2017-11-23 21:09:20

ubuntu

Tomcat vulnerabilities

2018-05-30 00:00:00

redhat

(RHSA-2018:0466) Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update

2018-03-07 15:08:21

(RHSA-2018:0465) Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update

2018-03-07 15:08:16

rosalinux

Advisory ROSA-SA-2021-1988

2021-07-02 18:17:52

symantec

SA156: Apache Tomcat Vulnerabilities Apr-Oct 2017

2017-11-07 08:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Related for RH:CVE-2017-12616