Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2025-31651

Опубликовано: 28 апр. 2025
Источник: nvd
CVSS3: 9.8
EPSS Низкий

Описание

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 9.0.0 (включая) до 9.0.104 (исключая)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 10.1.0 (включая) до 10.1.40 (исключая)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 11.0.0 (включая) до 11.0.6 (исключая)

EPSS

Процентиль: 23%
0.00073
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-116
CWE-116

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 2 месяцев назад

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVSS3: 5.3
redhat
около 2 месяцев назад

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVSS3: 9.8
debian
около 2 месяцев назад

Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ...

suse-cvrf
8 дней назад

Security update for tomcat

github
около 2 месяцев назад

Apache Tomcat Rewrite rule bypass

EPSS

Процентиль: 23%
0.00073
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-116
CWE-116