Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2008-2370

Published: 04/08/2008 Updated: 13/02/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Apache

Vulnerability Summary

Apache Tomcat 4.1.0 up to and including 4.1.37, 5.5.0 up to and including 5.5.26, and 6.0.0 up to and including 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote malicious users to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat 4.1.2

apache tomcat 4.1.35

apache tomcat 4.1.36

apache tomcat 5.5.18

apache tomcat 4.1.21

apache tomcat 6.0.6

apache tomcat 6.0.11

apache tomcat 5.5.12

apache tomcat 5.5.14

apache tomcat 4.1.24

apache tomcat 5.5.10

apache tomcat 5.5.4

apache tomcat 5.5.7

apache tomcat 5.5.1

apache tomcat 6.0.7

apache tomcat 5.5.11

apache tomcat 4.1.25

apache tomcat 6.0.4

apache tomcat 5.5.6

apache tomcat 5.5.26

apache tomcat 4.1.4

apache tomcat 5.5.20

apache tomcat 5.5.15

apache tomcat 5.5.5

apache tomcat 4.1.27

apache tomcat 6.0.15

apache tomcat 4.1.30

apache tomcat 4.1.7

apache tomcat 4.1.11

apache tomcat 5.5.21

apache tomcat 4.1.18

apache tomcat 5.5.22

apache tomcat 4.1.14

apache tomcat 6.0.10

apache tomcat 6.0.3

apache tomcat 4.1.19

apache tomcat 6.0.9

apache tomcat 4.1.31

apache tomcat 5.5.3

apache tomcat 4.1.16

apache tomcat 4.1.29

apache tomcat 4.1.22

apache tomcat 4.1.5

apache tomcat 4.1.26

apache tomcat 4.1.13

apache tomcat 4.1.8

apache tomcat 5.5.9

apache tomcat 5.5.25

apache tomcat 6.0.0

apache tomcat 4.1.17

apache tomcat 6.0.14

apache tomcat 5.5.2

apache tomcat 4.1.33

apache tomcat 5.5.0

apache tomcat 4.1.1

apache tomcat 5.5.13

apache tomcat 6.0.1

apache tomcat 6.0.12

apache tomcat 5.5.24

apache tomcat 4.1.12

apache tomcat 4.1.28

apache tomcat 4.1.15

apache tomcat 4.1.10

apache tomcat 5.5.8

apache tomcat 5.5.16

apache tomcat 4.1.0

apache tomcat 6.0.5

apache tomcat 4.1.20

apache tomcat 5.5.17

apache tomcat 4.1.3

apache tomcat 5.5.19

apache tomcat 4.1.23

apache tomcat 4.1.34

apache tomcat 4.1.32

apache tomcat 4.1.37

apache tomcat 6.0.2

apache tomcat 6.0.13

apache tomcat 5.5.23

apache tomcat 4.1.6

apache tomcat 6.0.16

apache tomcat 6.0.8

apache tomcat 4.1.9

Vendor Advisories

Red Hat: Important: tomcat security update
Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix multiple security issues are now availablefor Red Hat Developer Suite 3This update has been rated as having important security impact by the RedHat Security Response Team D ...
Red Hat: Important: tomcat security update
Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Application Server v2This update has been rated as having important security impact by the RedHat Security Response Team ...
Red Hat: Important: jbossweb security update
Synopsis Important: jbossweb security update Type/Severity Security Advisory: Important Topic An updated jbossweb package that fixes various security issues is nowavailable for JBoss Enterprise Application Platform (JBoss EAP) 42 and43This update has been rated as having important security impact by the ...
Red Hat: Low: tomcat security update for Red Hat Network Satellite Server
Synopsis Low: tomcat security update for Red Hat Network Satellite Server Type/Severity Security Advisory: Low Topic Updated tomcat packages that fix multiple security issues are now availablefor Red Hat Network Satellite ServerThis update has been rated as having low security impact by the RedHat Security ...

Exploits

Exploit DB: Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure
source: wwwsecurityfocuscom/bid/30494/info Apache Tomcat is prone to a remote information-disclosure vulnerability Remote attackers can exploit this issue to obtain the contents of sensitive files stored on the server Information obtained may lead to further attacks The following versions are affected: Tomcat 410 through 4137 To ...

References

CWE-22http://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://www.securityfocus.com/bid/30494http://www.securitytracker.com/id?1020623http://secunia.com/advisories/31639http://secunia.com/advisories/31379http://secunia.com/advisories/31381http://www.redhat.com/support/errata/RHSA-2008-0648.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:188https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.htmlhttp://secunia.com/advisories/31891https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.htmlhttp://secunia.com/advisories/31865http://www.redhat.com/support/errata/RHSA-2008-0862.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0864.htmlhttp://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlhttp://www.securityfocus.com/bid/31681http://support.apple.com/kb/HT3216http://secunia.com/advisories/32222http://support.avaya.com/elmodocs2/security/ASA-2008-401.htmhttp://securityreason.com/securityalert/4099http://secunia.com/advisories/31982http://marc.info/?l=bugtraq&m=123376588623823&w=2http://secunia.com/advisories/33797http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlhttp://secunia.com/advisories/32120http://secunia.com/advisories/32266http://www.vmware.com/security/advisories/VMSA-2009-0002.htmlhttp://www.vupen.com/english/advisories/2009/0503http://secunia.com/advisories/33999http://secunia.com/advisories/34013http://secunia.com/advisories/35393http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.htmlhttp://www.vupen.com/english/advisories/2009/1535http://www.vupen.com/english/advisories/2009/2215http://secunia.com/advisories/36249http://secunia.com/advisories/37460http://www.vupen.com/english/advisories/2009/3316http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2008/2780http://www.vupen.com/english/advisories/2009/0320http://www.vupen.com/english/advisories/2008/2823http://www.vupen.com/english/advisories/2008/2305http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/57126https://exchange.xforce.ibmcloud.com/vulnerabilities/44156https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5876https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10577http://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/495022/100/0/threadedhttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2008:0864https://www.exploit-db.com/exploits/32137/
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook