Back

MEDIUM

tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

Published Feb 28, 2018

Description

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

References (71)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Feb 28, 2018
Updated Sep 17, 2024
Reserved Dec 7, 2017
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Jan 31, 2018
GHSA-6RXJ-58JH-436R