Apache Tomcat 7

The finding maps to CVE-2015-5174. In Apache Tomcat 7.0.0 through 7.0.64, a path validation bug lets code running inside a webapp call ServletContext.getResource() / getResourceAsStream() / getResourcePaths() with "/.." and get a directory listing of the parent deployment directory. Apache is explicit that this only matters when you are running untrusted web applications under a Java SecurityManager; the usual exposure is disclosure of $CATALINA_BASE/webapps, not arbitrary file read or code execution.

The scanner's MEDIUM label overstates real enterprise risk. Apache itself rated it Low, and that is the right instinct: the attacker typically needs to have already crossed a much bigger line first by deploying or controlling an app on the target Tomcat instance. In most enterprise fleets, Tomcat is not used as hostile multi-tenant shared hosting, and Java SecurityManager-based sandboxing is uncommon enough that the reachable population is narrow before the bug even starts to matter.

Why this verdict

• Major friction: attacker needs app control first — this is not a clean unauthenticated edge exploit; it assumes authenticated deployment rights or an already-compromised app.
• Population narrows again with SecurityManager — Apache explicitly scopes impact to deployments running untrusted webapps under a SecurityManager, a pattern that is uncommon in modern enterprise application hosting.
• Impact is bounded — the primitive usually exposes a parent directory listing like $CATALINA_BASE/webapps, which is useful recon but not arbitrary file read or code execution by itself.
• Vendor baseline is inflated for operations — a scanner's generic MEDIUM is understandable from raw CVSS mechanics, but it ignores that the path to exploitation starts after a bigger compromise milestone.

Why not higher?

It is not higher because this is not an internet-edge RCE, not a credential bypass, and not even a general file-read primitive. The chain depends on rare deployment assumptions: shared Tomcat hosting, untrusted apps, SecurityManager isolation, and an attacker who already has application-level foothold.

Why not lower?

It is not IGNORE because the bug does break an intended sandbox boundary, and in the specific shared-hosting model it can leak deployment structure for neighboring apps. If you actually run adversarial or separately managed tenants on one Tomcat instance, that is a real cross-app isolation failure.

1. Restrict deployment rights — Lock down Tomcat Manager, CI/CD service accounts, and filesystem write paths so only tightly scoped admins can deploy or modify applications. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is the single best control because it removes the prerequisite the attacker really needs.
2. Isolate applications per instance — Move away from shared multi-app Tomcat where feasible so one compromised app cannot enumerate sibling deployments. For LOW, there is no mitigation SLA; fold this into platform hardening and modernization work rather than an emergency change.
3. Verify package backports before chasing versions — On distro-managed systems, check the package advisory rather than only the upstream 7.0.65 string, because vendor backports may already contain the fix. For LOW, do this during normal vulnerability review and backlog hygiene.
4. Watch webapps/ for drift — File integrity monitoring and EDR on deployed WARs/JSPs and exploded app directories catch the real dangerous event here: unauthorized app deployment or modification. Again, LOW means no formal mitigation deadline, but the control is high-value broadly.

Run this on the target Tomcat host as a user with read access to the Tomcat install. Invoke it with the Tomcat base path, for example: bash check_cve_2015_5174.sh /opt/tomcat. It needs no root privileges, but distro-packaged/backported builds may return UNKNOWN by design.

#!/usr/bin/env bash
# check_cve_2015_5174.sh
# Detects likely exposure to CVE-2015-5174 for Apache Tomcat 7.x
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-${CATALINA_HOME:-}}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/tomcat"
  exit 2
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - target path does not exist: $TARGET"
  exit 2
fi

get_version() {
  local base="$1"
  local out=""

  if [[ -x "$base/bin/version.sh" ]]; then
    out=$("$base/bin/version.sh" 2>/dev/null | awk -F': ' '/Server number/ {print $2; exit}')
    if [[ -n "$out" ]]; then
      echo "$out"
      return 0
    fi
  fi

  local jar=""
  for jar in "$base/lib/catalina.jar" "$base/server/lib/catalina.jar"; do
    if [[ -f "$jar" ]]; then
      out=$(unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | awk -F': ' '/Implementation-Version/ {print $2; exit}')
      if [[ -n "$out" ]]; then
        echo "$out"
        return 0
      fi
    fi
  done

  return 1
}

ver=$(get_version "$TARGET") || {
  echo "UNKNOWN - could not determine Tomcat version from $TARGET"
  exit 2
}

ver=$(echo "$ver" | tr -d '\r' | xargs)

# Distro/backport hinting: raw upstream comparison is unsafe when suffixes are present.
if [[ "$ver" =~ [+-] || "$ver" =~ (deb|el|ubuntu|redhat|amzn|suse|dfsg) ]]; then
  echo "UNKNOWN - version '$ver' looks distro-packaged/backported; verify package advisory instead"
  exit 2
fi

if [[ ! "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  echo "UNKNOWN - unrecognized version format: $ver"
  exit 2
fi

IFS='.' read -r major minor patch <<< "$ver"

# This check is scoped to Tomcat 7.x because the finding presented is Tenable plugin 121117.
if [[ "$major" != "7" ]]; then
  echo "UNKNOWN - detected Tomcat $ver; this script is scoped to Tomcat 7.x"
  exit 2
fi

if (( minor != 0 )); then
  echo "UNKNOWN - unexpected Tomcat 7 minor version format: $ver"
  exit 2
fi

if (( patch < 65 )); then
  echo "VULNERABLE - Tomcat version $ver is earlier than 7.0.65"
  exit 1
else
  echo "PATCHED - Tomcat version $ver is 7.0.65 or later"
  exit 0
fi

Sources

1. Tenable Plugin 121117
2. Apache Tomcat 7 vulnerabilities page
3. NVD CVE-2015-5174
4. CVE.org record
5. CVE Details entry
6. Debian security tracker
7. Ubuntu CVE page
8. CISA Known Exploited Vulnerabilities Catalog