The JULI logging component in Tomcat versions 5.5.9 through 5.5.25 and versions 6.0.0 to 6.0.15 allows web applications to provide their own logging configurations. The default security policy does not restrict this configuration and allows an untrusted web application to add files or overwrite existing files where the Tomcat process has the necessary file permissions to do so.
66606f1673de22575c8893d54b52647fdb228feb8f44f542c4a94d96aaa28b7d