deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-w5r3-gr8w-7fj5
Package: io.jenkins.plugins:eggplant-runner (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-1188: Initialization of a Resource with an Insecure Default
Vulnerable versions: <= 0.0.1.301.v963cffe8ddb
Patched in: unpatched

Summary: Jenkins Eggplant Runner Plugin protection mechanism disabled

Details:
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value as part of applying a proxy configuration.

This disables a protection mechanism of the Java runtime addressing CVE-2016-5597.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-93mh-mx9w-m69q
Package: org.jenkins-ci.plugins:themis (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 1.4.1
Patched in: unpatched

Summary: Jenkins Themis Plugin vulnerable to cross-site request forgery

Details:
Jenkins Themis Plugin 1.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-23vj-j6jc-w892
Package: org.jenkins-ci.plugins:curseforge-publisher (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: <= 1.0
Patched in: unpatched

Summary: Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

Details:
Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these keys, increasing the potential for attackers to observe and capture them.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-6mgr-3374-4p3c
Package: org.jenkins-ci.plugins:windocks-start-container (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 1.4
Patched in: unpatched

Summary: Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery

Details:
Jenkins Start Windocks Containers Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-3jw2-5hjg-hc2c
Package: jp.ikedam.jenkins.plugins:extensible-choice-parameter (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 239.v5f5c278708cf
Patched in: unpatched

Summary: Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

Details:
Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute sandboxed Groovy code.

As of publication of this advisory, there is no fix.
GitHub Security Advisory: GHSA-mrpq-9jr3-rqq9
Package: io.jenkins.plugins:mcp-server (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 0.86.v7d3355e6a
Patched in: 0.86.v7d3355e6a

Summary: Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

Details:
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in several MCP tools.

This allows to do the following:

- Attackers with Item/Read permission can obtain information about the configured SCM in a job despite lacking Item/Extended Read permission (`getJobScm`).

- Attackers with Item/Read permission can trigger new builds of a job despite lacking Item/Build permission (`triggerBuild`).

- Attackers without Overall/Read permission can retrieve the names of configured clouds (`getStatus`).

MCP Server Plugin 0.86.v7d3355e6a_a_18 performs permission checks for the affected MCP tools.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 9.0.23, < 9.0.106
Patched in: 9.0.106

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 10.1.0, < 10.1.42
Patched in: 10.1.42

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 11.0.0-M1, < 11.0.8
Patched in: 11.0.8

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 9.0.23, < 9.0.106
Patched in: 9.0.106

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 10.1.0, < 10.1.42
Patched in: 10.1.42

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 11.0.0-M1, < 11.0.8
Patched in: 11.0.8

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 9.0.23, < 9.0.106
Patched in: 9.0.106

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 10.1.0, < 10.1.42
Patched in: 10.1.42

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-42wg-hm62-jcwg
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: >= 11.0.0-M1, < 11.0.8
Patched in: 11.0.8

Summary: Apache Tomcat installer for Windows has an untrusted search path vulnerability

Details:
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-c6cm-5gc7-c3f4
Package: org.keycloak:keycloak-quarkus-server (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-427: Uncontrolled Search Path Element
Vulnerable versions: <= 26.4.2
Patched in: unpatched

Summary: Duplicate Advisory:  Keycloak allows access to admin path through flaw

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.

### Original Description
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.
GitHub Security Advisory: GHSA-xcj6-xpjg-c4xr
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 92.0.2
Patched in: 92.0.2

Summary: Liferay Portal Stores Password Reset Tokens in Plain Text

Details:
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
GitHub Security Advisory: GHSA-xcj6-xpjg-c4xr
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.100
Patched in: 7.4.3.100

Summary: Liferay Portal Stores Password Reset Tokens in Plain Text

Details:
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
GitHub Security Advisory: GHSA-vgqx-447m-wvcj
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.100
Patched in: 7.4.3.100

Summary: Liferay Portal Vulnerable to DoS via Crafted Headless API Request

Details:
Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.
GitHub Security Advisory: GHSA-gv7w-jh8g-vr73
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.110
Patched in: 7.4.3.110

Summary: Liferay Portal Does Not Limit Access to APIs Before Email Verification

Details:
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.
GitHub Security Advisory: GHSA-gh4w-8qgq-8w9r
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.4.0-ga1, < 7.4.3.108
Patched in: 7.4.3.108

Summary: Liferay Portal Vulnerable to CSRF in Headless APIs

Details:
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.
GitHub Security Advisory: GHSA-8mgf-rgg5-w38q
Package: com.liferay:com.liferay.account.admin.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.0.108
Patched in: 2.0.108

Summary: Liferay Portal Vulnerable to Cross-Site Scripting

Details:
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role page.

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Organization’s “Name” text field to (1) view account page, (2) view account organization page, or (3) select account organization page.
GitHub Security Advisory: GHSA-cw79-fq4f-9r96
Package: com.liferay:com.liferay.portal.security.ldap.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 4.0.2, < 4.0.54
Patched in: 4.0.54

Summary: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature

Details:
Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.
GitHub Security Advisory: GHSA-2pwh-9q9q-5r9c
Package: com.liferay:com.liferay.layout.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 5.0.8, < 5.0.157
Patched in: 5.0.157

Summary: Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter

Details:
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.
GitHub Security Advisory: GHSA-p72g-pv48-7w9x
Package: org.apache.tika:tika-parsers (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 1.13, < 2.0.0-ALPHA
Patched in: 2.0.0-ALPHA

Summary: Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Details:
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.
GitHub Security Advisory: GHSA-vfww-5hm6-hx2j
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 9.6)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 9.0.40, < 9.0.109
Patched in: 9.0.109

Summary: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Details:
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-vfww-5hm6-hx2j
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 9.6)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 9.0.40, < 9.0.109
Patched in: 9.0.109

Summary: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Details:
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-vfww-5hm6-hx2j
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 9.6)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 9.0.40, < 9.0.109
Patched in: 9.0.109

Summary: Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Details:
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 9.0.0-M11, < 9.0.109
Patched in: 9.0.109

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.