MediumFix available
tomcat6, tomcat7 and 1 more products — security advisory
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
- Products
- tomcat6, tomcat7, tomcat9
- Affected versions
- 6.0.37-1, 6.0.39-1, 6.0.41-4, 7.0.42-1, 7.0.47-1, 7.0.50-1, 7.0.52-1, 7.0.52-1ubuntu0.1, 7.0.52-1ubuntu0.3
- Fixed versions
- 6.0.39-1ubuntu0.1, 6.0.45+dfsg-1, 7.0.52-1ubuntu0.6, 9.0.16-3~18.04.1
- CVEs
- CVE-2015-5345
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:21 UTC · Revision 1
Source evidence
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
osv:UBUNTU-CVE-2015-5345
tomcat6
Fixed versions: 6.0.39-1ubuntu0.1
tomcat7
Fixed versions: 7.0.52-1ubuntu0.6
tomcat6
Fixed versions: 6.0.45+dfsg-1
tomcat9
Fixed versions: 9.0.16-3~18.04.1
Complete source record
{
"id": "7e7144bc560220e7f1815187a321998eeb749eab4246a1fe5230aae53474b7ff",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-5345",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-5345",
"summary": "The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.",
"evidence": "osv:UBUNTU-CVE-2015-5345",
"products": [
{
"name": {
"value": "tomcat6",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.39-1ubuntu0.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "6.0.37-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.39-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "tomcat7",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.0.52-1ubuntu0.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "7.0.42-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.47-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.50-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.52-1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.52-1ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.52-1ubuntu0.3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "tomcat6",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.45+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "6.0.41-4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "tomcat9",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.16-3~18.04.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2015-5345",
"aliases": [
"UBUNTU-CVE-2015-5345"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.39-1ubuntu0.1"
}
]
}
],
"package": {
"name": "tomcat6",
"purl": "pkg:deb/ubuntu/tomcat6?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"6.0.37-1",
"6.0.39-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5345.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libservlet2.4-java",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "libservlet2.5-java",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "libtomcat6-java",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-admin",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-common",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-docs",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-examples",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-extras",
"binary_version": "6.0.39-1ubuntu0.1"
},
{
"binary_name": "tomcat6-user",
"binary_version": "6.0.39-1ubuntu0.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.52-1ubuntu0.6"
}
]
}
],
"package": {
"name": "tomcat7",
"purl": "pkg:deb/ubuntu/tomcat7?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"7.0.42-1",
"7.0.47-1",
"7.0.50-1",
"7.0.52-1",
"7.0.52-1ubuntu0.1",
"7.0.52-1ubuntu0.3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5345.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libservlet3.0-java",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "libtomcat7-java",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7-admin",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7-common",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7-docs",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7-examples",
"binary_version": "7.0.52-1ubuntu0.6"
},
{
"binary_name": "tomcat7-user",
"binary_version": "7.0.52-1ubuntu0.6"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.45+dfsg-1"
}
]
}
],
"package": {
"name": "tomcat6",
"purl": "pkg:deb/ubuntu/tomcat6?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"6.0.41-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5345.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libservlet2.5-java",
"binary_version": "6.0.45+dfsg-1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.16-3~18.04.1"
}
]
}
],
"package": {
"name": "tomcat9",
"purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5345.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libtomcat9-embed-java",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "libtomcat9-java",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9-admin",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9-common",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9-docs",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9-examples",
"binary_version": "9.0.16-3~18.04.1"
},
{
"binary_name": "tomcat9-user",
"binary_version": "9.0.16-3~18.04.1"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-17T12:52:52.105247400Z",
"provider": "osv",
"upstream": [
"CVE-2015-5345"
],
"references": [
"https://ubuntu.com/security/CVE-2015-5345",
"https://ubuntu.com/security/notices/USN-3024-1",
"https://www.cve.org/CVERecord?id=CVE-2015-5345"
]
},
"related_cves": [
{
"value": "CVE-2015-5345",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353332,
"published_at": "2016-02-24T00:00:00+00:00"
}