Description
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Published: 2016-02-25
Score: 5.3 Medium
EPSS: 18.4% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-435-1 tomcat6 security update
Debian DLA Debian DLA DLA-753-1 tomcat7 security update
Debian DSA Debian DSA DSA-3530-1 tomcat6 security update
Debian DSA Debian DSA DSA-3552-1 tomcat7 security update
Debian DSA Debian DSA DSA-3609-1 tomcat8 security update
Github GHSA Github GHSA GHSA-rh8q-vjgf-gf74 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Ubuntu USN Ubuntu USN USN-3024-1 Tomcat vulnerabilities
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=145974991225029&w=2 cve-icon cve-icon
http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-1089.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-2045.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-2599.html cve-icon cve-icon
http://seclists.org/bugtraq/2016/Feb/146 cve-icon cve-icon cve-icon
http://seclists.org/fulldisclosure/2016/Feb/122 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1715206 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1715207 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1715213 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1715216 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1716882 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1716894 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1717209 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1717212 cve-icon cve-icon
http://svn.apache.org/viewvc?view=revision&revision=1717216 cve-icon cve-icon
http://tomcat.apache.org/security-6.html cve-icon cve-icon
http://tomcat.apache.org/security-7.html cve-icon cve-icon
http://tomcat.apache.org/security-8.html cve-icon cve-icon
http://tomcat.apache.org/security-9.html cve-icon cve-icon
http://www.debian.org/security/2016/dsa-3530 cve-icon cve-icon
http://www.debian.org/security/2016/dsa-3552 cve-icon cve-icon
http://www.debian.org/security/2016/dsa-3609 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html cve-icon cve-icon
http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html cve-icon cve-icon
http://www.securityfocus.com/bid/83328 cve-icon cve-icon
http://www.securitytracker.com/id/1035071 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-3024-1 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2016:1087 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2016:1088 cve-icon cve-icon
https://bto.bluecoat.com/security-advisory/sa118 cve-icon cve-icon
https://bz.apache.org/bugzilla/show_bug.cgi?id=58765 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 cve-icon cve-icon
https://kc.mcafee.com/corporate/index?page=content&id=SB10156 cve-icon cve-icon
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2015-5345 cve-icon
https://security.gentoo.org/glsa/201705-09 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20180531-0001/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2015-5345 cve-icon
History

Wed, 14 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.26675}

 epss

{'score': 0.32296}

Subscriptions

Apache Tomcat
Canonical Ubuntu Linux
Debian Debian Linux
Redhat Enterprise Linux Jboss Enterprise Web Server
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-14T21:30:18.101Z

Reserved: 2015-07-01T00:00:00.000Z

Link: CVE-2015-5345

cve-icon Vulnrichment

Updated: 2024-08-06T06:41:09.298Z

cve-icon NVD

Status : Modified

Published: 2016-02-25T01:59:01.137

Modified: 2026-10-14T22:17:12.633

Link: CVE-2015-5345

cve-icon Redhat

Severity : Low

Publid Date: 2016-02-22T00:00:00Z

Links: CVE-2015-5345 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-552

    Files or Directories Accessible to External Parties