GitHub Advisoryadvisory · Maven

GHSA-w65j-cmqc-37p2 JULI logging component in Apache Tomcat does not restrict certain permissions for web applications

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-5342
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-juli
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat-juli: >= 5.5.9, <= 5.5.25 (no fix yet) • Maven org.apache.tomcat:tomcat-juli: >= 6.0.0, <= 6.0.15 (no fix yet)

Description

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the `org.apache.juli.FileHandler` handler.

Related

Alias · CVE (1)

  • CVE-2007-5342 The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References