| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 5.0, < 5.5.22≥ 6.0, < 6.0.10 | 5.5.226.0.10 |
| tomcat | ≥ 5.0.0, < 5.5.22≥ 6.0.0, < 6.0.10 | 5.5.226.0.10 |
Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) / (slash), (2) \ (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free