GitHub Advisoryadvisory · Maven

GHSA-v5p2-vg3c-pmrr Apache Tomcat Path Traversal Vulnerability

LOW Published 2022-05-01 Modified 2024-01-08 Official page ↗
Aliases
CVE-2007-5461
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Low
Weaknesses
CWE-22
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.0.0, <= 4.0.6 (no fix yet) • Maven org.apache.tomcat:tomcat: 4.1.0 (no fix yet) • Maven org.apache.tomcat:tomcat: 5.0.0 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.5.0, <= 5.5.25 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 6.0.0, <= 6.0.14 (no fix yet)

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

Related

Alias · CVE (1)

  • CVE-2007-5461 Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14,… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References