Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-42wg-hm62-jcwg

Опубликовано: 16 июн. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 8.4

Описание

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

EPSS

Процентиль: 4%
0.0002
Низкий

8.4 High

CVSS3

Дефекты

CWE-426

Связанные уязвимости

CVSS3: 8.4
ubuntu
около 2 месяцев назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS3: 8.4
nvd
около 2 месяцев назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS3: 8.4
debian
около 2 месяцев назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Win ...

CVSS3: 8.4
fstec
около 2 месяцев назад

Уязвимость программного обеспечения Apache Tomcat, связанная с использованием ненадёжного пути поиска, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 4%
0.0002
Низкий

8.4 High

CVSS3

Дефекты

CWE-426