ZeroDay Findings
Sign inSign up

Findings

CVE-2015-5174

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to…

Published Feb 25, 2016 · updated Oct 14, 2026 · n/a n/a

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2016 · NIST NVD

    Detected

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATA

  2. Oct 14, 2026 · NIST NVD

    Updated

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATA

Affected

  • cpe apache/tomcat6.0.0
  • cpe apache/tomcat6.0.1
  • cpe apache/tomcat6.0.2
  • cpe canonical/ubuntu linux12.04
  • cpe debian/debian linux7.0
  • cpe debian/debian linux8.0
  • vendor n/a n/aversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2015-5174

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname

    vulnerability.circl.lu
  • CVE.orgCVE-2015-5174

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-5174

    30-day exploitation probability 12.6%

    first.org
  • NIST NVDCVE-2015-5174

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/135883/Apache-Tomcat-Limited-Directory-Traversal.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References