Multiple vulnerabilities have been identified in Apache Tomcat, which could be exploited by attackers or malicious users to bypass restrictions, gain knowledge of sensitive information or manipulate data.
The first issue is caused by an input validation error when deploying WAR files, which could allow an attacker to create arbitrary content outside of the web root folder via a directory traversal.
The second vulnerability is caused by an error when deploying files after a failed undeploy, which could cause arbitrary files to be deployed without security constraints, making them accessible without authentication.
The third issue is caused by an input validation error when deploying and undeploying WAR files with specially crafted file names, which could allow an attacker to cause the deletion of the current contents of the host's work directory.
