Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
An error classified as CWE-116 (Improper Neutralization of Escape, Meta, or Control Sequences) affects the rewrite rules processing mechanism in Apache Tomcat. An attacker may send a specially crafted HTTP request which, in certain though unlikely rewrite rule configurations, causes their bypass. If such rules were the only layer of access control or other security policy, it is possible to circumvent them without any privileges or user interaction.
An attacker may bypass security restrictions enforced by rewrite rules, potentially leading to unauthorized access to protected resources, breach of confidentiality, integrity, and availability of the application.
Apache Tomcat should be updated to patched versions indicated in vendor references (announcement available at lists.apache.org). The vulnerability affects only configurations using rewrite rules — organizations not using the rewrite module are at lower risk. It is recommended to review existing rewrite rules for enforcement of critical security restrictions.
Apache Tomcat in versions: 11.0.0-M1 to 11.0.5, 10.1.0-M1 to 10.1.39, 9.0.0.M1 to 9.0.102. Version 8.5.0–8.5.100 is marked as EOL but also vulnerable. Older EOL versions may also be affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Tomcat
APPApache9.0.0 – 9.0.104 (bez)10.1.0 – 10.1.40 (bez)11.0.0 – 11.0.6 (bez)
Related vulnerabilities
Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To...
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5....
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM bas...
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty...