CVE-2008-0002
At a glance
- Source
- NVD
- EPSS
- EPSS 5.02 % · percentile 92 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
References
- http://securityreason.com/securityalert/3638
- http://www.securityfocus.com/bid/27703
- http://secunia.com/advisories/28915
- http://secunia.com/advisories/37460
- http://www.securityfocus.com/archive/1/487812/100/0/threaded
- http://www.securityfocus.com/bid/31681
- http://secunia.com/advisories/28834
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://www.vupen.com/english/advisories/2008/0488
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://tomcat.apache.org/security-6.html
- http://secunia.com/advisories/57126
- http://secunia.com/advisories/32222
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html
- http://security.gentoo.org/glsa/glsa-200804-10.xml
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html
- http://www.vupen.com/english/advisories/2008/2780
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- http://support.apple.com/kb/HT3216
- http://secunia.com/advisories/29711
- http://www.vupen.com/english/advisories/2009/3316
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-5x5f-9r6q-q7mh — Apache Tomcat Sensitive Information Disclosure
European references
- ENISA EUVD · EUVD-2022-2675
- GCVE · GCVE-0-2008-0002
CERT-FR advisories
- CERTFR-2014-AVI-089 — Multiples vulnérabilités dans HP XP P9000 Performance Advisor Software · cert.ssi.gouv.fr
- CERTA-2009-AVI-513 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTA-2008-AVI-492 — Multiples vulnérabilités dans Mac OS X · cert.ssi.gouv.fr
- CERTA-2008-AVI-066 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |