{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T22:15:32.706","vulnerabilities":[{"cve":{"id":"CVE-2025-49125","sourceIdentifier":"security@apache.org","published":"2025-06-16T15:15:24.850","lastModified":"2025-11-03T20:19:08.213","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación mediante una ruta o canal alternativo en Apache Tomcat. Al usar recursos previos o posteriores montados en una ubicación distinta a la raíz de la aplicación web, era posible acceder a ellos mediante una ruta inesperada. Es probable que dicha ruta no estuviera protegida por las mismas restricciones de seguridad que la ruta esperada, lo que permitió eludirlas. Este problema afecta a Apache Tomcat: de la 11.0.0-M1 a la 11.0.7, de la 10.1.0-M1 a la 10.1.41 y de la 9.0.0.M1 a la 9.0.105. Se recomienda actualizar a las versiones 11.0.8, 10.1.42 o 9.0.106, que solucionan el problema."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.106","matchCriteriaId":"D212C189-EFC0-43CC-89C0-DAD766413A98"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.0","versionEndExcluding":"10.1.42","matchCriteriaId":"573ACC55-1E48-4489-A269-12C1A4501DDA"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.0.8","matchCriteriaId":"EE393E87-D325-4ABB-B49C-5863ECD3DD83"}]}]}],"references":[{"url":"https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/16/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}