CVE-2015-5174

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2016
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-51757.5Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.CVE-2015-51765.8The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of CVE-2015-51777.5Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial o CVE-2015-51784.3The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send CVE-2015-51797.5FreeIPA might display user data improperly via vectors involving non-printable characters.CVE-2015-51807.5res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash CVE-2015-51815.4The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.CVE-2015-51828.8Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.CVE-2015-51837.5Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.CVE-2015-51847.5Console: CORS headers set to allow all in Red Hat AMQ.CVE-2015-51855.0The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL poin CVE-2015-51865.3Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.