CVE-2025-55754

{"id": "CVE-2025-55754", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55754", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T04:55:55.372090Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.10"}, {"status": "affected", "version": "10.1.0-M1", "versionType": "semver", "lessThanOrEqual": "10.1.44"}, {"status": "affected", "version": "9.0.40", "versionType": "semver", "lessThanOrEqual": "9.0.108"}, {"status": "affected", "version": "8.5.60", "versionType": "semver", "lessThanOrEqual": "8.5.100"}, {"status": "unknown", "version": "3", "lessThan": "8.5.0", "versionType": "semver"}, {"status": "unknown", "version": "10.0.0-M1", "versionType": "semver", "lessThanOrEqual": "10.0.27"}], "defaultStatus": "unaffected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-10-27T18:15:42.710", "references": [{"url": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/27/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.\n\nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Secuencias de Escape, Meta o Control en Apache Tomcat.\n\nTomcat no escapaba las secuencias de escape ANSI en los mensajes de registro. Si Tomcat se ejecutaba en una consola en un sistema operativo Windows, y la consola soportaba secuencias de escape ANSI, era posible para un atacante usar una URL especialmente dise\u00f1ada para inyectar secuencias de escape ANSI para manipular la consola y el portapapeles e intentar enga\u00f1ar a un administrador para que ejecutara un comando controlado por el atacante. Aunque no se encontr\u00f3 ning\u00fan vector de ataque, podr\u00eda haber sido posible montar este ataque en otros sistemas operativos.\n\nEste problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.10, desde 10.1.0-M1 hasta 10.1.44, desde 9.0.40 hasta 9.0.108.\n\nLas siguientes versiones estaban al final de su vida \u00fatil (EOL) en el momento en que se cre\u00f3 el CVE, pero se sabe que est\u00e1n afectadas: 8.5.60 hasta 8.5.100. Otras versiones m\u00e1s antiguas, EOL, tambi\u00e9n pueden estar afectadas.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 11.0.11 o posterior, 10.1.45 o posterior o 9.0.109 o posterior, que solucionan el problema."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8252492F-6708-4904-8F48-E53D31B6CAF7", "versionEndIncluding": "8.5.100", "versionStartIncluding": "8.5.60"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80305B12-76BD-409C-9B76-4FD6E849C049", "versionEndExcluding": "9.0.109", "versionStartIncluding": "9.0.40"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B30CA0D9-834D-4044-B03B-7E6E60A4B0E6", "versionEndExcluding": "10.0.27", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27F4F718-AE8D-417A-BEE4-780FD77625D2", "versionEndExcluding": "10.1.45", "versionStartIncluding": "10.1.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC2A3FE1-BC50-419D-AEFA-097C58A3F243", "versionEndExcluding": "11.0.11", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}