vulnwire
5.0med

CVE-2007-04501 exploit

Apache Tomcat Directory Traversal

Also known as GHSA-4prh-gqw8-rgh5

Published 19 y ago · modified 58 d ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
91.2%
percentile 100%
Public exploits
1
Exploit-DB

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Exploit prediction (EPSS)

91.16% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-29739 Apache Tomcat 5.x/6.0.x - Directory Traversal · remote · 2007-03-14

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat
>=5.0, <5.5.22
>=6.0, <6.0.10
5.5.22
6.0.10

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds
Apache HTTP Server (RSS, critical only)

References

  • tomcat.apache.org /security-4.html · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/30908 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.vmware.com /pipermail/security-announce/2008/000003.html · mailing-list, x_refsource_MLIST, x_transferred
  • vupen.com /english/advisories/2007/2732 · vdb-entry, x_refsource_VUPEN, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-239312-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • vupen.com /english/advisories/2007/3087 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/32988 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/30899 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/1979/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • novell.com /linux/security/advisories/2007_5_sr.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.apple.com /archives/security-announce//2007/Jul/msg00004.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • vupen.com /english/advisories/2008/0065 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/500412/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/33668 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/485938/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/500396/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/25280 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2007-0360.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/24732 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2009/0233 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/22960 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/28365 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • support.avaya.com /elmodocs2/security/ASA-2007-206.htm · x_refsource_CONFIRM, x_transferred
  • tomcat.apache.org /security-6.html · x_refsource_CONFIRM, x_transferred
  • sec-consult.com /287.html · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2007/3386 · vdb-entry, x_refsource_VUPEN, x_transferred
  • sec-consult.com /fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt · x_refsource_MISC, x_transferred
  • redhat.com /support/errata/RHSA-2007-0327.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/27037 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • docs.info.apple.com /article.html?artnum=306172 · x_refsource_CONFIRM, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01178795 · vendor-advisory, x_refsource_HP, x_transferred
  • vupen.com /english/advisories/2007/0975 · vdb-entry, x_refsource_VUPEN, x_transferred
  • tomcat.apache.org /security-5.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/25159 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/26660 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2008-0261.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • fujitsu.com /global/support/software/security/products-f/interstage-200702e.html · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/glsa-200705-03.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • secunia.com /advisories/25106 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityreason.com /securityalert/2446 · third-party-advisory, x_refsource_SREASON, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2007-0450 · advisory
  • github.com /apache/tomcat/commit/0c5ec5b958f1b59840ee155a23ab409755b039f6 · web
  • github.com /apache/tomcat/commit/19ec1ccd17fbb98511bc1c12b255253c4f48b85f · web
  • github.com /apache/tomcat/commit/ec7ff880dbc28b313bf3a2b1914f6f0371489793 · web
  • lists.apache.org /thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apa · web
  • lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apa · web
  • lists.apache.org /thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apa · web
  • lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apac · web
  • lists.apache.org /thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apac · web
  • lists.apache.org /thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apac · web
  • lists.apache.org /thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apac · web
  • lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apac · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.