CVE-2025-31651

Katalog CVE

CVSS 9.8 · Critical EPSS 4,2%

Kerentanan Improper Encoding or Escaping of Output pada apache tomcat. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Rincian

Terbit di NVD

28 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

4,2% peluang dieksploitasi; lebih tinggi dari 90,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/list.html?announce@tomcat.apache.org mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/04/28/3 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html