ZeroDay Findings
Sign inSign up

Findings

CVE-2015-5345

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security…

Published Feb 25, 2016 · updated Oct 14, 2026 · n/a n/a

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2016 · NIST NVD

    Detected

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Affected

  • cpe apache/tomcat6.0.0
  • cpe apache/tomcat6.0.1
  • cpe apache/tomcat6.0.2
  • cpe canonical/ubuntu linux12.04
  • cpe debian/debian linux7.0
  • cpe debian/debian linux8.0
  • vendor n/a n/aversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2015-5345

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that l

    vulnerability.circl.lu
  • CVE.orgCVE-2015-5345

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-5345

    30-day exploitation probability 18.4%

    first.org
  • NIST NVDCVE-2015-5345

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that l

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2015-5345 · ZeroDay Findings