CVE-2015-5345
libtomcat9-embed-java: The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M...
CVE-2015-5345 is fixed in 8 products on 1 platform, first by libtomcat9-embed-java 9.0.16-3~18.04.1, released February 23, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1838
97th percentile
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libtomcat9-embed-java · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | libtomcat9-embed-java 9.0.16-3~18.04.1 | Feb 23, 2016 |
| libtomcat9-java · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | libtomcat9-java 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9 · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9-admin · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9-admin 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9-common · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9-common 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9-docs · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9-docs 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9-examples · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9-examples 9.0.16-3~18.04.1 | Feb 23, 2016 |
| tomcat9-user · Ubuntu 18.04.6 LTS (bionic) | 9.0.16-3~18.04.1 | tomcat9-user 9.0.16-3~18.04.1 | Feb 23, 2016 |