Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-42wg-hm62-jcwg

Опубликовано: 16 июн. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 8.4

Описание

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

EPSS

Процентиль: 5%
0.00026
Низкий

8.4 High

CVSS3

Дефекты

CWE-426

Связанные уязвимости

CVSS3: 8.4
ubuntu
3 месяца назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS3: 8.4
nvd
3 месяца назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS3: 8.4
debian
3 месяца назад

Untrusted Search Path vulnerability in Apache Tomcat installer for Win ...

CVSS3: 8.4
fstec
3 месяца назад

Уязвимость программного обеспечения Apache Tomcat, связанная с использованием ненадёжного пути поиска, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 5%
0.00026
Низкий

8.4 High

CVSS3

Дефекты

CWE-426