CVE-2017-12616: Information Exposure

September 19, 2017 (updated April 15, 2019)

When using a VirtualDirContext with Apache Tomcat it is possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

References

www.securityfocus.com/bid/100897
www.securitytracker.com/id/1039393
nvd.nist.gov/vuln/detail/CVE-2017-12616

Code Behaviors & Features

Detect and mitigate CVE-2017-12616 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →