Skip to main content

CVE-2007-5461

Severity

5

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue. A workaround, as suggested in the security bulletin, is to "limit write access to trusted users."
Ref: http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%[email protected]%3E

Project

Apache Tomcat

Category
n/a
Tags
configuration
functional
Date Disclosed

2007-10-15

Date Discovered

2007-10-15

Apache Tomcat 6.0.x

First release:
2007-02-28
First release:
2016-12-31
CVEs:
48
Support Lifecycle:
Namespace:
javax
Feel Vulnerable? 

Contact us so we can help you.

* These fields are required.