Apache Tomcat Directory Traversal
Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a `..` (dot dot) sequence with combinations of (1) `/` (slash), (2) `\` (backslash), and (3) URL-encoded backslash (`%5C`) characters in the URL, which are valid separators in Tomcat but not in Apache.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2007-0450US | medium5.0 | Exploit | ||
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allow… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://docs.info.apple.com/article.html?artnum=306172WEB
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlWEB
- http://lists.vmware.com/pipermail/security-announce/2008/000003.htmlWEB
- http://security.gentoo.org/glsa/glsa-200705-03.xmlWEB
- http://tomcat.apache.org/security-4.htmlWEB
- http://tomcat.apache.org/security-5.htmlWEB
- http://tomcat.apache.org/security-6.htmlWEB
- http://www.redhat.com/support/errata/RHSA-2007-0327.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan