| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 8.5.0, < 8.5.16≥ 9.0.0.M1, < 9.0.0.M22 | 8.5.169.0.0.M22 |
| tomcat | = 8.5.0= 8.5.1= 8.5.10= 8.5.11= 8.5.12= 8.5.13= 8.5.14= 8.5.15= 8.5.2= 8.5.3= 8.5.4= 8.5.5= 8.5.6= 8.5.7= 8.5.8= 8.5.9= 9.0.0 |
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free