Description

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the …war filename.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2902

• http://tomcat.apache.org/security-5.html

• http://tomcat.apache.org/security-6.html

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2902