Detections
Analytics
Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1281)
high Nessus Plugin ID 274699
Language:
Synopsis
The remote Amazon Linux 2023 host is missing a security update.Description
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1281 advisory.Relative Path Traversal vulnerability in Apache Tomcat.
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.
The following versions were EOL at the time the CVE was created but areknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. (CVE-2025-55752)
Improper Resource Shutdown or Release vulnerability in Apache Tomcat.
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.
The following versions were EOL at the time the CVE was created but areknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue. (CVE-2025-61795)
Tenable has extracted the preceding description block directly from the tested product security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Run 'dnf update tomcat9 --releasever 2023.9.20251110' or or 'dnf update --advisory ALAS2023-2025-1281 --releasever 2023.9.20251110' to update your system.See Also
https://alas.aws.amazon.com//AL2023/ALAS2023-2025-1281.html
https://alas.aws.amazon.com/faqs.html
Plugin Details
Severity: High
ID: 274699
File Name: al2023_ALAS2023-2025-1281.nasl
Version: 1.1
Type: local
Agent: unix
Published: 11/11/2025
Updated: 11/11/2025
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2025-55752
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.7
Threat Score: 5.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:tomcat9-servlet-4.0-api, p-cpe:/a:amazon:linux:tomcat9, p-cpe:/a:amazon:linux:tomcat9-docs-webapp, p-cpe:/a:amazon:linux:tomcat9-jsp-2.3-api, p-cpe:/a:amazon:linux:tomcat9-el-3.0-api, p-cpe:/a:amazon:linux:tomcat9-webapps, p-cpe:/a:amazon:linux:tomcat9-lib, p-cpe:/a:amazon:linux:tomcat9-admin-webapps
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 11/10/2025
Vulnerability Publication Date: 9/8/2025
Reference Information
CVE: CVE-2025-55752, CVE-2025-61795
IAVA: 2025-A-0803