CyberRota Analysis
AI-GeneratedApache Tomcat versions 8.5.0 through 11.0.23 are vulnerable to a critical security flaw that allows attackers to bypass security constraints due to improper handling of URL encoding. This vulnerability poses a significant risk, particularly for configurations that rely on the rewrite valve, as it could lead to unauthorized access to sensitive resources. Organizations using affected versions should prioritize upgrading to 11.0.24, 10.1.57, or 9.0.120 to mitigate this risk.
Original NVD Description
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)