Threats tagged 'ghsa-mqg3-r7h5-24x4'

Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22 contain an Always-Incorrect Control Flow Implementation vulnerability. This flaw causes special roles and empty authorization constraints to be omitted when the effective web.xml configuration is logged. The issue is fixed in versions 8.5.101, 9.0.119, 10.1.56, and 11.0.23. The vulnerability has a CVSS score of 9.1, indicating critical severity with high confidentiality and integrity impact but no availability impact.