Content :
We reproduced the relative path traversal vulnerability affecting Apache Tomcat versions 8.5.6–8.5.100, 9.0.0.M11–9.0.108, 10.1.0-M1–10.1.44, and 11.0.0-M1–11.0.10. The issue arises when RewriteValve rules incorporate user-controlled query parameters into rewritten URLs. Tomcat normalises the rewritten URI before decoding it, permitting encoded ../ sequences to slip past security constraints. During our assessment we:
- Deployed a vulnerable Tomcat 9.0.108 instance with a rewrite rule representative of the affected applications.
- Confirmed that an encoded traversal payload (
path=%2FWEB-INF%2Fweb.xml) retrieves protected resources (HTTP 200) that should be inaccessible.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| QUESTION 1 | |
| Which SysV init configuration file should be modified to disable the ctrl-alt-delete key combination? | |
| A. /etc/keys | |
| B. /proc/keys | |
| C. /etc/inittab | |
| D. /proc/inittab | |
| E. /etc/reboot | |
| QUESTION 2 | |
| Which of the following information is stored within the BIOS? (Choose TWO correct answers.) |