Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2009-0783US | medium4.2 | — | ||
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows l… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlWEB
- http://marc.info/?l=bugtraq&m=127420533226623&w=2WEB
- http://marc.info/?l=bugtraq&m=129070310906557&w=2WEB
- http://marc.info/?l=bugtraq&m=136485229118404&w=2WEB
- http://secunia.com/advisories/35685WEB
- http://secunia.com/advisories/35788WEB
- http://secunia.com/advisories/37460WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan