https://bugzilla.redhat.com/show_bug.cgi?id=1636512
--- Comment #5 from Doran Moppert <dmoppert(a)redhat.com> ---
This vulnerability does not affect Tomcat 6.0.24 as Response.sendRedirect()
always sends an absolute URL.
Vulnerable versions of Tomcat may not be exploitable under either the following
conditions:
- if org.apache.catalina.STRICT_SERVLET_COMPLIANCE set to true
- if org.apache.catalina.servlets.DefaultServlet is either:
- not deployed at all
- only deployed with Context attribute useRelativeRedirects set to false
- only deploted with both Context attributes
mapperContextRootRedirectEnabled and mapperDirectoryRedirectEnabled are set to
false
--
You are receiving this mail because:
You are on the CC list for the bug.