Published: 12/09/2014 Updated: 07/01/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Unrestricted file upload vulnerability in Apache Tomcat 7.x prior to 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote malicious users to execute arbitrary code by uploading and accessing a JSP file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 7.0.11
apache tomcat 7.0.12
apache tomcat 7.0.19
apache tomcat 7.0.2
apache tomcat 7.0.26
apache tomcat 7.0.27
apache tomcat 7.0.33
apache tomcat 7.0.34
apache tomcat 7.0.4
apache tomcat 7.0.1
apache tomcat 7.0.10
apache tomcat 7.0.17
apache tomcat 7.0.18
apache tomcat 7.0.23
apache tomcat 7.0.24
apache tomcat 7.0.25
apache tomcat 7.0.31
apache tomcat 7.0.32
apache tomcat
apache tomcat 7.0.0
apache tomcat 7.0.15
apache tomcat 7.0.16
apache tomcat 7.0.21
apache tomcat 7.0.22
apache tomcat 7.0.3
apache tomcat 7.0.30
apache tomcat 7.0.37
apache tomcat 7.0.38
apache tomcat 7.0.13
apache tomcat 7.0.14
apache tomcat 7.0.20
apache tomcat 7.0.28
apache tomcat 7.0.29
apache tomcat 7.0.35
apache tomcat 7.0.36

It was discovered that malicious web applications could use the Expression Language to bypass protections of a Security Manager as expressions were evaluated within a privileged code section For the oldstable distribution (wheezy), this problem has been fixed in version 7028-4+deb7u3 This update also provides fixes for CVE-2013-4444, CVE-2014-0 ...

Unrestricted file upload vulnerability in Apache Tomcat 7x before 7040, in certain situations involving outdated javaioFile code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file ...

Full Disclosure mailing list archives   By Date By Thread </form>    Re: [SECURITY] CVE-2013-4444 Remote Code Execution in Apache Tomcat  <!--X-Head-of-Message- ...

CWE-94 http://archives.neohapsis.com/archives/bugtraq/2014-09/0075.html http://tomcat.apache.org/security-7.html http://openwall.com/lists/oss-security/2014/10/24/12 http://marc.info/?l=bugtraq&m=144498216801440&w=2 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.securityfocus.com/bid/69728 http://www.debian.org/security/2016/dsa-3447 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 http://www.securitytracker.com/id/1030834 http://seclists.org/fulldisclosure/2021/Jan/23 https://nvd.nist.gov https://www.debian.org/security/./dsa-3447 https://access.redhat.com/security/cve/cve-2013-4444

CVE-2013-4444

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect