CVE-2017-7675
En bref Sévérité Non disponible EPSS EPSS 10.14 % · centile 96 (2026-10-27) État PUBLISHED Publiée 2017-08-11 Mise à jour 2024-09-17 Attribuée par apache Statut NVD Modified Description The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Scores Version Score Vecteur Évalué par CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Avis GHSA-68g5-8q7f-m384 — Improper Limitation of a Pathname to a Restricted Directory in Apache TomcatRéférences européennes
Configurations affectées (CPE NVD) cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*Produits affectés
Références
Sources
