CVE-2025-49124
HIGH8.4EPSS 0.18%Apache Tomcat installer for Windows has an untrusted search path vulnerability
發布日:2025/6/16修改日:2025/10/29
描述
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
受影響套件(4)
- Bitnami/tomcat>= 9.0.23, < 9.0.107, >= 10.1.0, < 10.1.42, >= 11.0.0, < 11.0.9
- Maven/org.apache.tomcat.embed:tomcat-embed-core>= 11.0.0-M1, < 11.0.8
- Maven/org.apache.tomcat:tomcat>= 11.0.0-M1, < 11.0.8
- Maven/org.apache.tomcat:tomcat-catalina>= 11.0.0-M1, < 11.0.8
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
| osv | CVSS 3.1 | HIGH8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
參考連結(10)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-49124
- PATCHhttps://github.com/apache/tomcat
- WEBhttps://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823
- WEBhttps://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7
- WEBhttps://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49
- WEBhttps://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
- WEBhttps://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
- WEBhttps://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8
- WEBhttps://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
- WEBhttp://www.openwall.com/lists/oss-security/2025/06/16/3