CVE-2008-5515
At a glance
- Source
- NVD
- EPSS
- EPSS 18.68 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
- http://tomcat.apache.org/security-4.html
- http://marc.info/?l=bugtraq&m=127420533226623&w=2
- http://secunia.com/advisories/39317
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:138
- http://www.vupen.com/english/advisories/2009/1535
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html
- http://www.debian.org/security/2011/dsa-2207
- http://jvn.jp/en/jp/JVN63832775/index.html
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- http://secunia.com/advisories/37460
- http://www.vupen.com/english/advisories/2010/3056
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://secunia.com/advisories/35788
- http://www.securityfocus.com/archive/1/504202/100/0/threaded
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://www.securityfocus.com/bid/35263
- http://www.vupen.com/english/advisories/2009/1520
- http://secunia.com/advisories/44183
- http://www.vupen.com/english/advisories/2009/1856
- http://www.securityfocus.com/archive/1/504170/100/0/threaded
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:176
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://secunia.com/advisories/42368
- http://tomcat.apache.org/security-6.html
- http://secunia.com/advisories/35393
- http://support.apple.com/kb/HT4077
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6445
- http://secunia.com/advisories/35685
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html
- http://tomcat.apache.org/security-5.html
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
- http://marc.info/?l=bugtraq&m=129070310906557&w=2
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:136
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10422
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19452
- http://www.vupen.com/english/advisories/2009/3316
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-9737-qmgc-hfr9 — Directory Traversal in Apache Tomcat
European references
- ENISA EUVD · EUVD-2022-3308
- GCVE · GCVE-0-2008-5515
CERT-FR advisories
- CERTA-2011-AVI-221 — Multiples vulnérabilités dans Blackberry Enterprise Server · cert.ssi.gouv.fr
- CERTA-2010-AVI-220 — Multiples vulnérabilités dans HP Performance Manager · cert.ssi.gouv.fr
- CERTA-2010-AVI-143 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr
- CERTA-2009-AVI-513 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTA-2009-AVI-211 — Multiples vulnérabilités de Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.38:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*- +40 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |