CVE-2017-7675
N/A
Published: August 11, 2017 at 02:00 AM UTC
Updated: June 17, 2026 at 01:24 AM UTC
1 product affected across 1 vendorTomcat
Using Apache Tomcat by Apache Software Foundation?
Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 10%
Description
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
8.5.0 ≤ v ≤ 8.5.159.0.0.M1 ≤ v ≤ 9.0.0.M218.5.08.5.18.5.108.5.118.5.128.5.138.5.148.5.158.5.28.5.38.5.48.5.58.5.68.5.78.5.88.5.99.0.0 milestone19.0.0 milestone109.0.0 milestone119.0.0 milestone129.0.0 milestone139.0.0 milestone149.0.0 milestone159.0.0 milestone169.0.0 milestone179.0.0 milestone189.0.0 milestone199.0.0 milestone29.0.0 milestone209.0.0 milestone219.0.0 milestone39.0.0 milestone49.0.0 milestone59.0.0 milestone69.0.0 milestone79.0.0 milestone89.0.0 milestone9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (15)
Vendor Advisoryx_refsource_DEBIAN
Source: [email protected]
http://www.debian.org/security/2017/dsa-3974VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/100256Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/5f8ab8a02f3610bd56ea2b0d69af25cbde451d79c46276c350e05a15%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3EQuick Info
StatusMODIFIED
CWE
CWE-22
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card