CVE-2025-49125 - log back

CVE-2025-49125 edited at 18 Jun 2025 22:56:09
References
https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
+ https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
CVE-2025-49125 edited at 18 Jun 2025 22:54:24
References
https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9
+ https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
CVE-2025-49125 created at 18 Jun 2025 22:37:36
Severity
+ Low
Remote
+ Remote
Type
+ Access restriction bypass
Description
+ When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.
References
+ https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
+ https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
+ https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9
Notes