The vulnerability in Apache Tomcat's CGI servlet arises from improper handling of case sensitivity in the pathInfo component of URIs. This flaw permits bypassing security constraints that should restrict access based on URI pathInfo, potentially allowing unauthorized access or actions. The issue affects a wide range of Apache Tomcat versions from 6.x through 11.x, including many Ubuntu-packaged versions. The vendor has addressed the issue in Apache Tomcat versions 11.0.7, 10.1.41, and 9.0.105. Users running affected versions should upgrade to these fixed releases to mitigate the risk.

Successful exploitation of this vulnerability can lead to bypass of security constraints protecting resources accessed via the CGI servlet's pathInfo. This may result in unauthorized information disclosure, modification, or disruption of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with impacts on confidentiality, integrity, and availability rated as low to high. No known active exploits have been reported at this time.

A fix is available. Users should upgrade affected Apache Tomcat installations to versions 11.0.7, 10.1.41, or 9.0.105 or later, as recommended by the vendor. Applying these updates will remediate the improper case sensitivity handling in the CGI servlet. No other specific mitigations are indicated by the vendor advisory.