| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 7.0.23, < 7.0.91≥ 8.5.0, < 8.5.34≥ 9.0.0, < 9.0.12 | 7.0.918.5.349.0.12 |
| tomcat | = 9.0.0≥ 7.0.23, ≤ 7.0.90≥ 8.5.0, ≤ 8.5.33≥ 9.0.1, ≤ 9.0.11 | |
| communications application session controller | = 3.7.1= 3.8.0 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail order broker | = 15.0= 5.1= 5.2 | |
| secure global desktop | = 5.4 |
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン