K34341852 : Apache Tomcat 6.x vulnerability CVE-2015-5345

Security Advisory Description

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.67, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (CVE-2015-5345)

Impact

A remote attacker may be able to determine the existence of restricted directories by exploiting this vulnerability.

• BIG-IP/Enterprise Manager

The Tomcat service is not directly exposed to the network, as it only listens on a localhost socket with connections brokered through the Apache front-end web service.

• Traffix SDC

Exploitation of this vulnerability may occur if an attacker has access to the local network of the system; the Tomcat service is accessible only from the internal network.