Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2007-0450

Published: 16/03/2007 Updated: 13/02/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Apache

Vulnerability Summary

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x prior to 5.5.22 and 6.x prior to 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote malicious users to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat

apache http server -

Exploits

Exploit DB: Apache Tomcat 5.x/6.0.x - Directory Traversal
source: wwwsecurityfocuscom/bid/22960/info Apache HTTP servers running with the Tomcat servlet container are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data Exploiting this issue allows attackers to access arbitrary files in the Tomcat webroot This can expose sensitive inf ...
Exploit DB: SA-20070314-0.txt
SEC Consult Security Advisory 20070314-0 - If the Apache HTTP Server and Tomcat are configured to interoperate with the common proxy modules (mod_proxy, mod_rewrite, mod_jk), an attacker might be able to break out of the intended destination path up to the webroot in Tomcat ...

Github Repositories

https://github.com/ActualSalt/Capstone-Red-vs-Blue-CySec-Report

Repository project cybersecurity report on Capstone Red vs Blue

Capstone Red vs Blue CySec Report Author: Min Young Lee Preface This is a cybersecurity project report on a network vulnerability There are two parts of this project: the attacker (Red Team) and the victim (Blue Team) The Red Team is tasked with identifying vulnerabilities in the network and exploiting the found vulnerabilities The Blue Team is tasked with detecting malic

References

CWE-22http://www.securityfocus.com/bid/22960http://www.sec-consult.com/287.htmlhttp://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txthttp://www.novell.com/linux/security/advisories/2007_5_sr.htmlhttp://secunia.com/advisories/24732http://security.gentoo.org/glsa/glsa-200705-03.xmlhttp://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://secunia.com/advisories/25106http://www.redhat.com/support/errata/RHSA-2007-0327.htmlhttp://secunia.com/advisories/25280http://docs.info.apple.com/article.html?artnum=306172http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2007-206.htmhttp://lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0360.htmlhttp://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://www.securityfocus.com/bid/25159http://secunia.com/advisories/26235http://secunia.com/advisories/26660http://secunia.com/advisories/27037http://securityreason.com/securityalert/2446http://www.mandriva.com/security/advisories?name=MDKSA-2007:241http://lists.vmware.com/pipermail/security-announce/2008/000003.htmlhttp://secunia.com/advisories/28365http://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1http://secunia.com/advisories/30908http://secunia.com/advisories/30899http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540http://secunia.com/advisories/33668http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspxhttp://www.vupen.com/english/advisories/2009/0233http://www.vupen.com/english/advisories/2007/0975http://www.vupen.com/english/advisories/2007/3087http://www.vupen.com/english/advisories/2007/2732http://www.vupen.com/english/advisories/2007/3386http://www.vupen.com/english/advisories/2008/1979/referenceshttp://www.vupen.com/english/advisories/2008/0065http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795https://exchange.xforce.ibmcloud.com/vulnerabilities/32988https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10643http://www.securityfocus.com/archive/1/500412/100/0/threadedhttp://www.securityfocus.com/archive/1/500396/100/0/threadedhttp://www.securityfocus.com/archive/1/485938/100/0/threadedhttp://www.securityfocus.com/archive/1/462791/100/0/threadedhttps://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3Ehttps://nvd.nist.govhttps://github.com/ActualSalt/Capstone-Red-vs-Blue-CySec-Reporthttps://www.exploit-db.com/exploits/29739/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook