-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | < 5.5.34 | 5.5.34 |
| org.apache.tomcat:tomcat | maven | >= 6.0.0, < 6.0.33 | 6.0.33 |
| org.apache.tomcat:tomcat | maven | >= 7.0.0, < 7.0.19 | 7.0.19 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated handling of sendfile attributes in APR/NIO connectors. Key functions identified through commit diffs include: 1) Http11AprProcessor's process method which mishandled sendfile ranges, 2) NioEndpoint's processSendfile lacking boundary checks, and 3) Request.setAttribute allowing unsafe file path injection. These were directly patched in security updates (e.g., added canonical path checks, range validation), confirming their vulnerability pre-patch.