The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
49
Affected Products
80
References
apache / tomcat
| - |
| apache | tomcat | 9.0.0 - 9.0.4 | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| apache | tomcat | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | jboss_enterprise_web_server | - | - |
| debian | debian_linux | - | - |
| debian | debian_linux | - | - |
| debian | debian_linux | - | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| oracle | fusion_middleware | - | - |
| oracle | hospitality_guest_access | - | - |
| oracle | hospitality_guest_access | - | - |
| oracle | micros_relate_crm_software | - | - |
| oracle | secure_global_desktop | - | - |
| oracle | secure_global_desktop | - | - |
| redhat | jboss_middleware | - | - |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability
Impact