CVE-2015-5345

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
• http://marc.info/?l=bugtraq&m=145974991225029&w=2
• http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
• http://rhn.redhat.com/errata/RHSA-2016-1089.html
• http://rhn.redhat.com/errata/RHSA-2016-2045.html
• http://rhn.redhat.com/errata/RHSA-2016-2599.html
• http://seclists.org/bugtraq/2016/Feb/146
• http://seclists.org/fulldisclosure/2016/Feb/122
• http://svn.apache.org/viewvc?view=revision&revision=1715206
• http://svn.apache.org/viewvc?view=revision&revision=1715207
• http://svn.apache.org/viewvc?view=revision&revision=1715213
• http://svn.apache.org/viewvc?view=revision&revision=1715216
• http://svn.apache.org/viewvc?view=revision&revision=1716882
• http://svn.apache.org/viewvc?view=revision&revision=1716894
• http://svn.apache.org/viewvc?view=revision&revision=1717209
• http://svn.apache.org/viewvc?view=revision&revision=1717212
• http://svn.apache.org/viewvc?view=revision&revision=1717216
• http://tomcat.apache.org/security-6.htmlVendor Advisory
• http://tomcat.apache.org/security-7.htmlVendor Advisory
• http://tomcat.apache.org/security-8.htmlVendor Advisory
• http://tomcat.apache.org/security-9.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3530
• http://www.debian.org/security/2016/dsa-3552
• http://www.debian.org/security/2016/dsa-3609
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
• http://www.securityfocus.com/bid/83328
• http://www.securitytracker.com/id/1035071
• http://www.ubuntu.com/usn/USN-3024-1
• https://access.redhat.com/errata/RHSA-2016:1087
• https://access.redhat.com/errata/RHSA-2016:1088
• https://bto.bluecoat.com/security-advisory/sa118
• https://bz.apache.org/bugzilla/show_bug.cgi?id=58765
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
• https://kc.mcafee.com/corporate/index?page=content&id=SB10156
• https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
• https://security.gentoo.org/glsa/201705-09
• https://security.netapp.com/advisory/ntap-20180531-0001/
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
• http://marc.info/?l=bugtraq&m=145974991225029&w=2
• http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
• http://rhn.redhat.com/errata/RHSA-2016-1089.html
• http://rhn.redhat.com/errata/RHSA-2016-2045.html
• http://rhn.redhat.com/errata/RHSA-2016-2599.html
• http://seclists.org/bugtraq/2016/Feb/146
• http://seclists.org/fulldisclosure/2016/Feb/122
• http://svn.apache.org/viewvc?view=revision&revision=1715206
• http://svn.apache.org/viewvc?view=revision&revision=1715207
• http://svn.apache.org/viewvc?view=revision&revision=1715213
• http://svn.apache.org/viewvc?view=revision&revision=1715216
• http://svn.apache.org/viewvc?view=revision&revision=1716882
• http://svn.apache.org/viewvc?view=revision&revision=1716894
• http://svn.apache.org/viewvc?view=revision&revision=1717209
• http://svn.apache.org/viewvc?view=revision&revision=1717212
• http://svn.apache.org/viewvc?view=revision&revision=1717216
• http://tomcat.apache.org/security-6.htmlVendor Advisory
• http://tomcat.apache.org/security-7.htmlVendor Advisory
• http://tomcat.apache.org/security-8.htmlVendor Advisory
• http://tomcat.apache.org/security-9.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3530
• http://www.debian.org/security/2016/dsa-3552
• http://www.debian.org/security/2016/dsa-3609
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
• http://www.securityfocus.com/bid/83328
• http://www.securitytracker.com/id/1035071
• http://www.ubuntu.com/usn/USN-3024-1
• https://access.redhat.com/errata/RHSA-2016:1087
• https://access.redhat.com/errata/RHSA-2016:1088
• https://bto.bluecoat.com/security-advisory/sa118
• https://bz.apache.org/bugzilla/show_bug.cgi?id=58765
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
• https://kc.mcafee.com/corporate/index?page=content&id=SB10156
• https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
• https://security.gentoo.org/glsa/201705-09
• https://security.netapp.com/advisory/ntap-20180531-0001/

Published

Feb 25, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5339The core_enrol_get_enrolled_users web service in enrol/exter…
• CVE-2015-5340Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8…
• CVE-2015-5341mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8…
• CVE-2015-5342The choice module in Moodle through 2.6.11, 2.7.x before 2.7…
• CVE-2015-5343Integer overflow in util.c in mod_dav_svn in Apache Subversi…
• CVE-2015-5344The camel-xstream component in Apache Camel before 2.15.5 an…
• CVE-2015-5346Session fixation vulnerability in Apache Tomcat 7.x before 7…
• CVE-2015-5347Cross-site scripting (XSS) vulnerability in the getWindowOpe…
• CVE-2015-5348Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and…
• CVE-2015-5349The CSV export in Apache LDAP Studio and Apache Directory St…
• CVE-2015-5350In Garden versions 0.22.0-0.329.0, a vulnerability has been …
• CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache …