Fixed in Apache Tomcat 8.0.48

Low: Incorrectly documented CGI search algorithm CVE-2017-15706

As part of the fix for bug 61201, the description of the search algorithm used by the CGI Servlet to identify which script to execute was updated. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.

This was fixed in revision 1814827.

This issue was reported to the Apache Tomcat Security Team by Jan Michael Greiner on 17 September 2017 and made public on 31 January 2018.

Affects: 8.0.45 to 8.0.47