Published: 13/08/2008 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 520

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in Apache Tomcat 4.1.0 up to and including 4.1.37, 5.5.0 up to and including 5.5.26, and 6.0.0 up to and including 6.0.16, when allowLinking and UTF-8 are enabled, allows remote malicious users to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix multiple security issues are now availablefor Red Hat Developer Suite 3This update has been rated as having important security impact by the RedHat Security Response Team D ...

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Application Server v2This update has been rated as having important security impact by the RedHat Security Response Team ...

Synopsis Important: jbossweb security update Type/Severity Security Advisory: Important Topic An updated jbossweb package that fixes various security issues is nowavailable for JBoss Enterprise Application Platform (JBoss EAP) 42 and43This update has been rated as having important security impact by the ...

Synopsis Low: tomcat security update for Red Hat Network Satellite Server Type/Severity Security Advisory: Low Topic Updated tomcat packages that fix multiple security issues are now availablefor Red Hat Network Satellite ServerThis update has been rated as having low security impact by the RedHat Security ...

/*Apache Tomcat < 6018 UTF8 Directory Traversal Vulnerability get /etc/passwd Exploit c0d3r: mywisdom thanks for not being lame to change exploit author tis is one of my linux w0rm module for user enumerations, i've dual os worm thanks to: gunslinger,flyf666,petimati,kiddies,xtr0nic,c0mrade,n0te,v3n0m,iblis muda,cr4wl3r thanks to: isa m said, ...

Title: Apache Tomcat Directory Traversal Vulnerability Author: Simon Ryeo(bar4mi (at) gmailcom, barami (at) ahnlabcom) Severity: High Impact: Remote File Disclosure Vulnerable Version: prior to 6018 Solution: - Best Choice: Upgrade to 6018 (tomcatapacheorg) - Hot fix: Disable allowLinking or do not set URIencoding to utf8 in order ...

The Oracle Containers For Java (OC4J) in the Oracle Application Server 10g suffers from a directory traversal vulnerability ...

ToutVirtual VirtualIQ Pro version 32 build 7882 suffers from cross site scripting, cross site request forgery, directory traversal, and code execution vulnerabilities ...

Apache Tomcat versions prior to 6018 suffer from a directory traversal vulnerability ...

This module tests whether a directory traversal vulnerability is present in Trend Micro DLP (Data Loss Prevention) Appliance v55 build <= 1294 The vulnerability appears to be actually caused by the Tomcat UTF-8 bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938 This module simply tests for t ...

This module tests whether a directory traversal vulnerability is present in Trend Micro DLP (Data Loss Prevention) Appliance v5.5 build <= 1294. The vulnerability appears to be actually caused by the Tomcat UTF-8 bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938. This module simply tests for the same bug with Trend Micro specific settings. Note that in the Trend Micro appliance, /etc/shadow is not used and therefore password hashes are stored and anonymously accessible in the passwd file.

msf > use auxiliary/admin/http/trendmicro_dlp_traversal
msf auxiliary(trendmicro_dlp_traversal) > show actions
    ...actions...
msf auxiliary(trendmicro_dlp_traversal) > set ACTION < action-name >
msf auxiliary(trendmicro_dlp_traversal) > show options
    ...show and set options...
msf auxiliary(trendmicro_dlp_traversal) > run

This module tests whether a directory traversal vulnerability is present in Trend Micro DLP (Data Loss Prevention) Appliance v5.5 build <= 1294. The vulnerability appears to be actually caused by the Tomcat UTF-8 bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938. This module simply tests for the same bug with Trend Micro specific settings. Note that in the Trend Micro appliance, /etc/shadow is not used and therefore password hashes are stored and anonymously accessible in the passwd file.

msf > use auxiliary/admin/http/trendmicro_dlp_traversal
msf auxiliary(trendmicro_dlp_traversal) > show actions
    ...actions...
msf auxiliary(trendmicro_dlp_traversal) > set ACTION < action-name >
msf auxiliary(trendmicro_dlp_traversal) > show options
    ...show and set options...
msf auxiliary(trendmicro_dlp_traversal) > run

Reproducible exploits for: CVE-2016-1240 CVE-2008-2938 CVE-2014-2064 CVE-2014-1904

Offensive technologies course This repository contains descriptions of several vulnerabilities and the code that exploits them Exploitable environments can be found in /dockerfiles/victim folder Attacker environments can be found in /dockerfiles/attacker folder Everything comes as Docker images Exploited CVEs: CVE-2008-2938 (Tomcat path traversal) CVE-2014-1904 (Spring pat

CWE-22 http://tomcat.apache.org/security-6.html http://www.securityfocus.com/bid/30633 http://www.redhat.com/support/errata/RHSA-2008-0648.html http://www.kb.cert.org/vuls/id/343355 http://secunia.com/advisories/31639 http://www.securitytracker.com/id?1020665 http://tomcat.apache.org/security-4.html http://tomcat.apache.org/security-5.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://secunia.com/advisories/31891 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html http://secunia.com/advisories/31865 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html http://www.redhat.com/support/errata/RHSA-2008-0862.html http://www.redhat.com/support/errata/RHSA-2008-0864.html http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html http://www.securityfocus.com/bid/31681 http://support.apple.com/kb/HT3216 http://secunia.com/advisories/32222 http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm http://securityreason.com/securityalert/4148 http://secunia.com/advisories/31982 http://marc.info/?l=bugtraq&m=123376588623823&w=2 http://secunia.com/advisories/33797 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://secunia.com/advisories/32120 http://secunia.com/advisories/32266 http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt http://secunia.com/advisories/37297 http://www.vupen.com/english/advisories/2009/0320 http://www.vupen.com/english/advisories/2008/2823 http://www.vupen.com/english/advisories/2008/2343 http://www.vupen.com/english/advisories/2008/2780 https://exchange.xforce.ibmcloud.com/vulnerabilities/44411 https://www.exploit-db.com/exploits/6229 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10587 http://www.securityfocus.com/archive/1/507729/100/0/threaded http://www.securityfocus.com/archive/1/495318/100/0/threaded https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2008:0864 https://github.com/Naramsim/Offensive https://www.exploit-db.com/exploits/14489/https://www.kb.cert.org/vuls/id/343355

CVE-2008-2938

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect