CVE-2015-5345

5.3 MEDIUM
Published: February 25, 2016 Modified: May 06, 2026
View on NVD

Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
Source: secalert@redhat.com
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
Source: secalert@redhat.com
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
Source: secalert@redhat.com
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
Source: secalert@redhat.com
http://marc.info/?l=bugtraq&m=145974991225029&w=2
Source: secalert@redhat.com
http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
Source: secalert@redhat.com
http://rhn.redhat.com/errata/RHSA-2016-1089.html
Source: secalert@redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2045.html
Source: secalert@redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2599.html
Source: secalert@redhat.com
http://seclists.org/bugtraq/2016/Feb/146
Source: secalert@redhat.com
http://seclists.org/fulldisclosure/2016/Feb/122
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1715206
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1715207
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1715213
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1715216
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1716882
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1716894
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1717209
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1717212
Source: secalert@redhat.com
http://svn.apache.org/viewvc?view=revision&revision=1717216
Source: secalert@redhat.com
http://tomcat.apache.org/security-6.html
Source: secalert@redhat.com
Vendor Advisory
http://tomcat.apache.org/security-7.html
Source: secalert@redhat.com
Vendor Advisory
http://tomcat.apache.org/security-8.html
Source: secalert@redhat.com
Vendor Advisory
http://tomcat.apache.org/security-9.html
Source: secalert@redhat.com
Vendor Advisory
http://www.debian.org/security/2016/dsa-3530
Source: secalert@redhat.com
http://www.debian.org/security/2016/dsa-3552
Source: secalert@redhat.com
http://www.debian.org/security/2016/dsa-3609
Source: secalert@redhat.com
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Source: secalert@redhat.com
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Source: secalert@redhat.com
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Source: secalert@redhat.com
http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
Source: secalert@redhat.com
http://www.securityfocus.com/bid/83328
Source: secalert@redhat.com
http://www.securitytracker.com/id/1035071
Source: secalert@redhat.com
http://www.ubuntu.com/usn/USN-3024-1
Source: secalert@redhat.com
https://access.redhat.com/errata/RHSA-2016:1087
Source: secalert@redhat.com
https://access.redhat.com/errata/RHSA-2016:1088
Source: secalert@redhat.com
https://bto.bluecoat.com/security-advisory/sa118
Source: secalert@redhat.com
https://bz.apache.org/bugzilla/show_bug.cgi?id=58765
Source: secalert@redhat.com
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
Source: secalert@redhat.com
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
Source: secalert@redhat.com
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
Source: secalert@redhat.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10156
Source: secalert@redhat.com
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
Source: secalert@redhat.com
https://security.gentoo.org/glsa/201705-09
Source: secalert@redhat.com
https://security.netapp.com/advisory/ntap-20180531-0001/
Source: secalert@redhat.com
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://marc.info/?l=bugtraq&m=145974991225029&w=2
Source: af854a3a-2127-422b-91ae-364da2661108
http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://rhn.redhat.com/errata/RHSA-2016-1089.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://rhn.redhat.com/errata/RHSA-2016-2045.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://rhn.redhat.com/errata/RHSA-2016-2599.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://seclists.org/bugtraq/2016/Feb/146
Source: af854a3a-2127-422b-91ae-364da2661108
http://seclists.org/fulldisclosure/2016/Feb/122
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1715206
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1715207
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1715213
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1715216
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1716882
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1716894
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1717209
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1717212
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.apache.org/viewvc?view=revision&revision=1717216
Source: af854a3a-2127-422b-91ae-364da2661108
http://tomcat.apache.org/security-6.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://tomcat.apache.org/security-7.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://tomcat.apache.org/security-8.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://tomcat.apache.org/security-9.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.debian.org/security/2016/dsa-3530
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.debian.org/security/2016/dsa-3552
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.debian.org/security/2016/dsa-3609
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/83328
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id/1035071
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.ubuntu.com/usn/USN-3024-1
Source: af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2016:1087
Source: af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2016:1088
Source: af854a3a-2127-422b-91ae-364da2661108
https://bto.bluecoat.com/security-advisory/sa118
Source: af854a3a-2127-422b-91ae-364da2661108
https://bz.apache.org/bugzilla/show_bug.cgi?id=58765
Source: af854a3a-2127-422b-91ae-364da2661108
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
Source: af854a3a-2127-422b-91ae-364da2661108
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
Source: af854a3a-2127-422b-91ae-364da2661108
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
Source: af854a3a-2127-422b-91ae-364da2661108
https://kc.mcafee.com/corporate/index?page=content&id=SB10156
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.gentoo.org/glsa/201705-09
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.netapp.com/advisory/ntap-20180531-0001/
Source: af854a3a-2127-422b-91ae-364da2661108

102 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.3 / 10.0
EPSS (Exploit Probability)
43.3%
98th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

apache canonical debian

Related CVEs

CVE-2026-6222 5.3
CVE-2026-40003 5.1
CVE-2026-44597 3.7
CVE-2026-6278 N/A
CVE-2026-41484 5.3