UpHeron
All vulnerabilities

Servers and applications

CVE-2017-7675

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.

Severity
High 7.5
Published
11 Aug 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone21
  • Version 9.0.0-milestone20
  • Version 9.0.0-milestone19
  • Version 9.0.0-milestone18
All 37 release lines
  • Version 8.5.0
  • Version 8.5.1
  • Version 8.5.2
  • Version 8.5.3
  • Version 8.5.4
  • Version 8.5.5
  • Version 8.5.6
  • Version 8.5.7
  • Version 8.5.8
  • Version 8.5.9
  • Version 8.5.10
  • Version 8.5.11
  • Version 8.5.12
  • Version 8.5.13
  • Version 8.5.14
  • Version 8.5.15
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone2
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone5
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone10
  • Version 9.0.0-milestone11
  • Version 9.0.0-milestone12
  • Version 9.0.0-milestone13
  • Version 9.0.0-milestone14
  • Version 9.0.0-milestone15
  • Version 9.0.0-milestone16
  • Version 9.0.0-milestone17
  • Version 9.0.0-milestone18
  • Version 9.0.0-milestone19
  • Version 9.0.0-milestone20
  • Version 9.0.0-milestone21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-7675
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-7675