Apache Tomcat is prone to a directory-traversal vulnerability and to an authentication-bypass vulnerability. Exploiting this issue allows attackers to delete arbitrary files within the context of the current working directory or gain unauthorized access to files and directories.. The following versions are affected: Tomcat 5.5.0 through 5.5.28 Tomcat 6.0.0 through 6.0.20

The vendor has released updates. Please see the references for details.

• http://svn.apache.org/viewvc?view=revision&revision=892815
• http://svn.apache.org/viewvc?view=revision&revision=902650
• http://tomcat.apache.org/
• http://www.securityfocus.com/bid/37942
• http://www.securityfocus.com/bid/37944
• http://www.securityfocus.com/bid/37945

---

Updated on 2015-03-25