CVE-2008-2370

Severity

7.5

Description

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Apache Tomcat 6.0.x

First release:

2007-02-28

First release:

2016-12-31

CVEs:

Support Lifecycle:

Unsupported

Namespace:

javax

6.0.13 6.0.14 6.0.16

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.

CVE-2008-2370

Severity

7.5

Description

Related links:

Project

Category

Tags

Date Disclosed

Date Discovered

Apache Tomcat 6.0.x

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.

Tomitribe

Services

Open Source