Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-02511

Опубликовано: 10 мар. 2025
Источник: fstec
CVSS3: 8.8
CVSS2: 10
EPSS Критический

Описание

Уязвимость сервера приложений Apache Tomcat связана с принятием входных данных пути в виде внутренней точки без проверки. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации и выполнить произвольный код

Вендор

ООО «Ред Софт»
АО «ИВК»
Apache Software Foundation
АО "НППКТ"

Наименование ПО

РЕД ОС
Альт 8 СП
Apache Tomcat
ОСОН ОСнова Оnyx

Версия ПО

7.3 (РЕД ОС)
- (Альт 8 СП)
от 11.0.0-M1 до 11.0.2 включительно (Apache Tomcat)
от 10.1.0-M1 до 10.1.34 включительно (Apache Tomcat)
от 9.0.0.M1 до 9.0.98 включительно (Apache Tomcat)
до 2.13 (ОСОН ОСнова Оnyx)

Тип ПО

Операционная система
Сетевое программное средство

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3
АО «ИВК» Альт 8 СП -
АО "НППКТ" ОСОН ОСнова Оnyx до 2.13

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://tomcat.apache.org/security-9.html
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
Для ОС Альт 8 СП: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/
Обновление программного обеспечения tomcat9 до версии 9.0.43+repack-2~deb11u12.osnova2u1

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 100%
0.93655
Критический

8.8 High

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 8.8
redos
3 месяца назад

Уязвимость tomcat

CVSS3: 9.8
ubuntu
3 месяца назад

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by defaul...

CVSS3: 8.6
redhat
3 месяца назад

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled ...

CVSS3: 9.8
nvd
3 месяца назад

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled

CVSS3: 9.8
debian
3 месяца назад

Path Equivalence: 'file.Name' (Internal Dot) leading toRemote Code Exe ...

EPSS

Процентиль: 100%
0.93655
Критический

8.8 High

CVSS3

10 Critical

CVSS2