Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

GHSA-8qq4-8jvq-mfw4

HIGH

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Also known asCVE-2017-12616
Published
May 14, 2022
Updated
Feb 20, 2024
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
90.6%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
89.3%90.2%91.1%92.0%89.8%90.6%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected
☕org.apache.tomcat:tomcat-catalina

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.apache.tomcat:tomcat-catalina≥ 7.0.0&&< 7.0.817.0.81

Frequently Asked Questions

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
O3 Security · Impact-Aware SCA

Is GHSA-8qq4-8jvq-mfw4 in your stack?

O3 detects GHSA-8qq4-8jvq-mfw4 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works