Threats affecting pkg:maven/org.apache.openejb/tomee-catalina

Apache TomEE versions from 1.5.1 through 1.7.5, 7.0.0-M1 through before 10.0.0-M1, 10.0.0-M1 through before 10.3.0, and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where the default configuration silently adds an administrative user with a well-known password if no users are defined. This allows remote attackers to authenticate using these default credentials and gain administrative access. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE contains an incorrect authorization vulnerability in its optional request routing feature. This flaw allows requests to be forwarded to their configured destinations without enforcing the security constraints or protections of the target web application's private directories. If the routing configuration copies client-controlled parts of the request path, a remote attacker may access protected resources or read sensitive application configuration and class files. The issue affects specific versions of Apache TomEE and is fixed in versions 10.3.0 and 11.0.0-M2.