UpHeron
All vulnerabilities

Servers and applications

CVE-2015-5174

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the…

Severity
Medium 4.3
Published
25 Feb 2016
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 8.0.26
  • Version 8.0.24
  • Version 8.0.23
  • Version 8.0.22
All 90 release lines
  • Version 6.0.0-alpha
  • Version 6.0.0
  • Version 6.0.1-alpha
  • Version 6.0.1
  • Version 6.0.2-alpha
  • Version 6.0.2-beta
  • Version 6.0.2
  • Version 6.0.4-alpha
  • Version 6.0.4
  • Version 6.0.10
  • Version 6.0.11
  • Version 6.0.13
  • Version 6.0.14
  • Version 6.0.16
  • Version 6.0.18
  • Version 6.0.20
  • Version 6.0.24
  • Version 6.0.26
  • Version 6.0.28
  • Version 6.0.29
  • Version 6.0.30
  • Version 6.0.32
  • Version 6.0.33
  • Version 6.0.35
  • Version 6.0.36
  • Version 6.0.37
  • Version 6.0.39
  • Version 6.0.41
  • Version 6.0.43
  • Version 6.0.44
  • Version 7.0.0-beta
  • Version 7.0.2-beta
  • Version 7.0.4-beta
  • Version 7.0.5-beta
  • Version 7.0.6
  • Version 7.0.10
  • Version 7.0.11
  • Version 7.0.12
  • Version 7.0.14
  • Version 7.0.16
  • Version 7.0.19
  • Version 7.0.20
  • Version 7.0.21
  • Version 7.0.22
  • Version 7.0.23
  • Version 7.0.25
  • Version 7.0.26
  • Version 7.0.27
  • Version 7.0.28
  • Version 7.0.29
  • Version 7.0.30
  • Version 7.0.32
  • Version 7.0.33
  • Version 7.0.34
  • Version 7.0.35
  • Version 7.0.37
  • Version 7.0.39
  • Version 7.0.40
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.47
  • Version 7.0.50
  • Version 7.0.52
  • Version 7.0.53
  • Version 7.0.54
  • Version 7.0.55
  • Version 7.0.56
  • Version 7.0.57
  • Version 7.0.59
  • Version 7.0.61
  • Version 7.0.62
  • Version 7.0.63
  • Version 7.0.64
  • Version 8.0.0-rc1
  • Version 8.0.0-rc3
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0.1
  • Version 8.0.11
  • Version 8.0.12
  • Version 8.0.14
  • Version 8.0.15
  • Version 8.0.17
  • Version 8.0.18
  • Version 8.0.20
  • Version 8.0.21
  • Version 8.0.22
  • Version 8.0.23
  • Version 8.0.24
  • Version 8.0.26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-5174
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-5174