{"id":"CVE-2015-5345","published":"2016-02-25T01:00:00Z","modified":"2026-10-14T21:30:18Z","title":"The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.1838,"percentile":0.97218,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","tags":["x_refsource_CONFIRM"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1715216","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/201705-09","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10156","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://tomcat.apache.org/security-9.html","tags":["x_refsource_CONFIRM"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1715213","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html","tags":["x_refsource_MISC"]},{"url":"http://www.ubuntu.com/usn/USN-3024-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2045.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2016/dsa-3530","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1715206","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=145974991225029&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1089.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1087","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1035071","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://bto.bluecoat.com/security-advisory/sa118","tags":["x_refsource_CONFIRM"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1088","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1717212","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20180531-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/bugtraq/2016/Feb/146","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1716894","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1717209","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/83328","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1715207","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2599.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.debian.org/security/2016/dsa-3609","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1717216","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","tags":["x_refsource_CONFIRM"]},{"url":"http://www.debian.org/security/2016/dsa-3552","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://seclists.org/fulldisclosure/2016/Feb/122","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=58765","tags":["x_refsource_CONFIRM"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1716882","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":28.2,"factors":[{"name":"EPSS percentile","points":19.44},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"referencesTotal":51,"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M2",">=8.0.0-RC1, <8.0.30",">=7.0.0, <7.0.68",">=6.0.0, <6.0.45"],"patched":["9.0.0.M2","8.0.30","7.0.68","6.0.45"],"from":["GHSA-rh8q-vjgf-gf74"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5174","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html"],"lineage":{"familyId":"fam-apache-tomcat-cve-2014-0119","parents":[{"from":"CVE-2014-0119","to":"CVE-2015-5345","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/servlets/DefaultServlet.java"],"commits":["https://github.com/apache/tomcat80/commit/d59fd4398c8ae6361e0b13c491f66b51e49a7441","https://github.com/apache/tomcat80/commit/7d33457de5fc5a652a88fb9bbc9ba4cbbda58f04","https://github.com/apache/tomcat80/commit/c15c2aba8eb42425f9ebcfcaef579dada38ad3a2"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2015-5345","to":"CVE-2017-5664","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/servlets/DefaultServlet.java"],"commits":["https://github.com/apache/tomcat80/commit/c15c2aba8eb42425f9ebcfcaef579dada38ad3a2","https://github.com/apache/tomcat80/commit/e070a31ec81b56377822e44883c64abb41f36a3b","https://github.com/apache/tomcat80/commit/25d3c0d93190ef165ecd6c744bc15b5059abfa8f"],"basis":"shared function","functions":["serveResource"]}]}],"packageHistory":[{"cve":"CVE-2014-0230","published":"2015-06-07","fixed":"8.0.9","kev":false,"link":{"from":"CVE-2014-0230","to":"CVE-2015-5345","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.44","toFixed":"6.0.45","daysApart":263}]}},{"cve":"CVE-2015-5174","published":"2016-02-25","fixed":"8.0.27","kev":false,"link":{"from":"CVE-2015-5174","to":"CVE-2015-5345","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.0.27","toFixed":"8.0.30","daysApart":0}]}},{"cve":"CVE-2016-0762","published":"2017-08-10","fixed":"9.0.0.M10","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2016-0762","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.45","toFixed":"6.0.46","daysApart":532}]}},{"cve":"CVE-2016-6796","published":"2017-08-11","fixed":"9.0.0.M10","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2016-6796","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.45","toFixed":"6.0.46","daysApart":533}]}},{"cve":"CVE-2016-8747","published":"2017-03-14","fixed":"9.0.0.M16","kev":false},{"cve":"CVE-2017-5647","published":"2017-04-17","fixed":"9.0.0.M19","kev":false},{"cve":"CVE-2017-5650","published":"2017-04-17","fixed":"9.0.0.M19","kev":false},{"cve":"CVE-2015-5345","published":"2016-02-25","fixed":"9.0.0.M2","kev":false},{"cve":"CVE-2015-5346","published":"2016-02-25","fixed":"9.0.0.M2","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2015-5346","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.0.30","toFixed":"8.0.31","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.66","toFixed":"7.0.68","daysApart":0}]}},{"cve":"CVE-2015-5351","published":"2016-02-25","fixed":"9.0.0.M2","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2015-5351","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.0.30","toFixed":"8.0.31","daysApart":0}]}},{"cve":"CVE-2016-0706","published":"2016-02-25","fixed":"9.0.0.M2","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2016-0706","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.0.30","toFixed":"8.0.31","daysApart":0}]}},{"cve":"CVE-2016-0714","published":"2016-02-25","fixed":"9.0.0.M2","kev":false,"link":{"from":"CVE-2015-5345","to":"CVE-2016-0714","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.68","toFixed":"7.0.70","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.45","toFixed":"6.0.46","daysApart":0}]}}],"package":"Maven:org.apache.tomcat:tomcat"}}