Test ID:	1.3.6.1.4.1.25623.1.0.154400
Category:	Web Servers
Title:	Apache Tomcat Rewrite Rule Bypass Vulnerability (Apr 2025) - Windows
Summary:	Apache Tomcat is prone to a rewrite rule bypass; vulnerability.
Description:	Summary: Apache Tomcat is prone to a rewrite rule bypass vulnerability. Vulnerability Insight: For a subset of unlikely rewrite rule configurations, it is possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. Affected Software/OS: Apache Tomcat version 9.0.102 and prior, 10.x through 10.1.39 and 11.0.0-M1 through 11.0.5. Note: While not explicitly mentioned by the vendor (due to the EOL status of these branches) it is assumed that the whole 10.x branch and all versions prior to 9.x are affected by these flaws. If you disagree with this assessment and want to accept the risk please create an override for this result. Solution: Update to version 9.0.104, 10.1.40, 11.0.6 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2025-31651
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.