Apache Tomcat CVE-2014-0096 Weak Authentication Vulnerability

Description

The default servlet allows web applications to define (at multiple levels) an XSLT to be used to format a directory listing. When running under a security manager, the processing of these was not subject to the same constraints as the web application. This enabled a malicious web application to bypass the file access constraints imposed by the security manager via the use of external XML entities.

Affected Applications

Apache Tomcat

CVE References

Other References