CVE-2025-55754
BaseFortify
Publication date: 2025-10-27
Last updated on: 2025-11-14
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | From 8.5.60 (inc) to 8.5.100 (inc) |
| apache | tomcat | From 9.0.40 (inc) to 9.0.109 (exc) |
| apache | tomcat | From 10.0.0 (inc) to 10.0.27 (exc) |
| apache | tomcat | From 10.1.0 (inc) to 10.1.45 (exc) |
| apache | tomcat | From 11.0.0 (inc) to 11.0.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-150 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Tomcat involves improper neutralization of ANSI escape sequences in log messages. When Tomcat runs in a Windows console that supports ANSI escape sequences, an attacker could craft a URL that injects these sequences into the console logs. This could allow the attacker to manipulate the console display and clipboard, potentially tricking an administrator into executing commands controlled by the attacker. Although no attack vector was confirmed, the vulnerability might also affect other operating systems.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to manipulate the console output and clipboard of an administrator monitoring Apache Tomcat logs. This manipulation could be used to deceive the administrator into running malicious commands, potentially leading to unauthorized system control or compromise.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Tomcat to version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later, which fix the issue.