漏洞描述 Apache Tomcat是美国阿帕奇(Apache)基金会的一款轻量级Web应用服务器。用于实现对Servlet和JavaServer Page(JSP)的支持。 Apache Tomcat 11.0.0-M1至11.0.2版本、10.1.0-M1至10.1.34版本和9.0.0.M1至9.0.98版本存在环境问题漏洞。攻击者利用该漏洞可以远程执行代码或泄露敏感信息。
相关漏洞推荐 Apache Tomcat URL重写绕过漏洞 (CVE-2025-55752) tomcat-default-login: Apahce Tomcat Manager Default Login POC CVE-2020-13935: Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service POC CVE-2007-2449: Apache Tomcat 4.x-7.x - Cross-Site Scripting CVE-2016-8735: Apache Tomcat - Remote Code Execution via JMX Ports POC CVE-2017-12615: Apache Tomcat Servers - Remote Code Execution POC CVE-2017-12617: Apache Tomcat - Remote Code Execution POC CVE-2018-11759: Apache Tomcat JK Connect <=1.2.44 - Manager Access POC CVE-2018-11784: Apache Tomcat - Open Redirect POC CVE-2019-0221: Apache Tomcat - Cross-Site Scripting POC CVE-2019-0232: Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution POC CVE-2020-9484: Apache Tomcat Remote Command Execution POC CVE-2025-24813: Apache Tomcat Path Equivalence - Remote Code Execution