CVE-2017-7675
Last modified
CVE-2017-7675 is a vulnerability of currently unknown severity. The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.. EPSS estimates a 10.14% chance of exploitation in the next 30 days.
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Tomcat | 8.5.0 | — |
| Apache | Tomcat | 8.5.1 | — |
| Apache | Tomcat | 8.5.2 | — |
| Apache | Tomcat | 8.5.3 | — |
| Apache | Tomcat | 8.5.4 | — |
| Apache | Tomcat | 8.5.5 | — |
| Apache | Tomcat | 8.5.6 | — |
| Apache | Tomcat | 8.5.7 | — |
| Apache | Tomcat | 8.5.8 | — |
| Apache | Tomcat | 8.5.9 | — |
| Apache | Tomcat | 8.5.10 | — |
| Apache | Tomcat | 8.5.11 | — |
| Apache | Tomcat | 8.5.12 | — |
| Apache | Tomcat | 8.5.13 | — |
| Apache | Tomcat | 8.5.14 | — |
| Apache | Tomcat | 8.5.15 | — |
| Apache | Tomcat | 9.0.0 | Milestone1 |
References
- http://www.securityfocus.com/bid/100256Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/100256Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7675?
How severe is CVE-2017-7675?
How do I fix CVE-2017-7675?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7669In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the …
- CVE-2017-7670The Traffic Router component of the incubating Apache Traffi…
- CVE-2017-7671There is a DOS attack vulnerability in Apache Traffic Server…
- CVE-2017-7672If an application allows enter an URL in a form field and bu…
- CVE-2017-7673Apache OpenMeetings 1.0.0 uses not very strong cryptographic…
- CVE-2017-7674The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.…
- CVE-2017-7676Policy resource matcher in Apache Ranger before 0.7.1 ignore…
- CVE-2017-7677In environments that use external location for hive tables, …
- CVE-2017-7678In Apache Spark before 2.2.0, it is possible for an attacker…
- CVE-2017-7679In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26,…
- CVE-2017-7680Apache OpenMeetings 1.0.0 has an overly permissive crossdoma…
- CVE-2017-7681Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. Th…
Are you affected by CVE-2017-7675?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST