Not rated
CVE-2017-12616 When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints…
Description
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tomcat | Versions not published |
References
- 1039393 www.securitytracker.com
- support.hpe.com support.hpe.com
- www.synology.com www.synology.com
- RHSA-2018:0465 access.redhat.com
- USN-3665-1 usn.ubuntu.com
- 100897 www.securityfocus.com
- RHSA-2018:0466 access.redhat.com
- security.netapp.com security.netapp.com
- [announce] 20170919 [SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure lists.apache.org
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update lists.debian.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Tomcat
The 141 CVEs of Apache Tomcat →
CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body…
Not rated
CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…
Not rated
CVE-2026-101296
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…
Not rated
CVE-2026-93446
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
Not rated