PT-2025-45666 · Maven · Org.Apache.Tomcat.Embed:Tomcat-Embed-Core+2

Publicado 2025-06-16 · Atualizado 2025-06-16

OSV

CVSS v4.0

4.8

Média

Vetor base

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

GHSA-42WG-HM62-JCWG

Produtos afetados

Org.Apache.Tomcat.Embed:Tomcat-Embed-Core

Org.Apache.Tomcat:Tomcat

Org.Apache.Tomcat:Tomcat-Catalina

Referências · 11

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823 · Nota
• https://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49 · Nota
• https://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-49124 · Nota de Segurança
• http://openwall.com/lists/oss-security/2025/06/16/3 · Nota
• https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv · Nota
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106 · Nota
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8 · Nota
• https://osv.dev/vulnerability/GHSA-42wg-hm62-jcwg · Aviso do Fabricante
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42 · Nota