| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat-catalina | ≥ 7.0.0, < 7.0.81 | 7.0.81 |
| tomcat | = 7.0.0= 7.0.1= 7.0.10= 7.0.11= 7.0.12= 7.0.13= 7.0.14= 7.0.15= 7.0.16= 7.0.17= 7.0.18= 7.0.19= 7.0.2= 7.0.20= 7.0.21= 7.0.22= 7.0.23= 7.0.24= 7.0.25= 7.0.26= 7.0.27= 7.0.28= 7.0.29= 7.0.3= 7.0.30= 7.0.31= 7.0.32= 7.0.33= 7.0.34= 7.0.35= 7.0.36= 7.0.37= 7.0.38= 7.0.39= 7.0.4= 7.0.40= 7.0.41= 7.0.42= 7.0.43= 7.0.44= 7.0.45= 7.0.46= 7.0.47= 7.0.48= 7.0.49= 7.0.5= 7.0.50= 7.0.51= 7.0.54= 7.0.55= 7.0.56= 7.0.57= 7.0.58= 7.0.59= 7.0.6= 7.0.60= 7.0.61= 7.0.62= 7.0.63= 7.0.64= 7.0.65= 7.0.66= 7.0.67= 7.0.68= 7.0.69= 7.0.7= 7.0.70= 7.0.71= 7.0.72= 7.0.73= 7.0.74= 7.0.75= 7.0.76= 7.0.77= 7.0.79= 7.0.8= 7.0.80= 7.0.9 |
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free