Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache Tomcat 权限许可和访问控制问题漏洞
Vulnerability Description
Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat中存在安全漏洞，该漏洞源于程序没有正确限制类加载器访问使用XSLT样式表的XML解析器。远程攻击者可借助特制的Web应用程序利用该漏洞读取任意文件，或读取不同Web应用程序相关的文件。以下版本受到影响：Apache Tomcat 6.0.39及之前的版本，7.0.54之前的7.x版本，8.0.6之前的8.x版
CVSS Information
N/A
Vulnerability Type
N/A