Apache Tomcat Path Traversal Vulnerability

Also known as GHSA-m8h8-6rvg-f4mg

Published 18 y ago 2008-08-04 · modified 4 mo ago 2026-06-16 · JSON

CVSS

5.0

v2.0 · NVD

CISA KEV

not known exploited

EPSS

52.7%

percentile 99%

Public exploits

Exploit-DB

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Exploit prediction (EPSS)

52.72% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

EDB-32137 Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure · remote · 2008-08-01

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.tomcat:tomcat`	>=4.1.0, <4.1.38 >=5.5.0, <5.5.27 >=6.0.0, <6.0.18	4.1.38 5.5.27 6.0.18

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

securityfocus.com /bid/30494 · vdb-entry, x_refsource_BID, x_transferred
tomcat.apache.org /security-4.html · x_refsource_CONFIRM, x_transferred
securityfocus.com /archive/1/495022/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10577 · vdb-entry, signature, x_refsource_OVAL, x_transferred
vupen.com /english/advisories/2009/1535 · vdb-entry, x_refsource_VUPEN, x_transferred
redhat.com /support/errata/RHSA-2008-0862.html · vendor-advisory, x_refsource_REDHAT, x_transferred
secunia.com /advisories/34013 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vupen.com /english/advisories/2008/2823 · vdb-entry, x_refsource_VUPEN, x_transferred
secunia.com /advisories/37460 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vmware.com /security/advisories/VMSA-2009-0002.html · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/31982 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securityfocus.com /bid/31681 · vdb-entry, x_refsource_BID, x_transferred
secunia.com /advisories/32120 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vmware.com /security/advisories/VMSA-2009-0016.html · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/33999 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/31865 · third-party-advisory, x_refsource_SECUNIA, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5876 · vdb-entry, signature, x_refsource_OVAL, x_transferred
securityreason.com /securityalert/4099 · third-party-advisory, x_refsource_SREASON, x_transferred
redhat.com /archives/fedora-package-announce/2008-September/msg00889.html · vendor-advisory, x_refsource_FEDORA, x_transferred
secunia.com /advisories/31639 · third-party-advisory, x_refsource_SECUNIA, x_transferred
lists.opensuse.org /opensuse-security-announce/2008-09/msg00004.html · vendor-advisory, x_refsource_SUSE, x_transferred
mandriva.com /security/advisories?name=MDVSA-2008:188 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
secunia.com /advisories/31379 · third-party-advisory, x_refsource_SECUNIA, x_transferred
support.avaya.com /elmodocs2/security/ASA-2008-401.htm · x_refsource_CONFIRM, x_transferred
vupen.com /english/advisories/2009/0320 · vdb-entry, x_refsource_VUPEN, x_transferred
securityfocus.com /archive/1/507985/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
redhat.com /support/errata/RHSA-2008-0864.html · vendor-advisory, x_refsource_REDHAT, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/44156 · vdb-entry, x_refsource_XF, x_transferred
lists.opensuse.org /opensuse-security-announce/2009-02/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
tomcat.apache.org /security-6.html · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/35393 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/57126 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/32222 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/36249 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/31891 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/33797 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securitytracker.com /id?1020623 · vdb-entry, x_refsource_SECTRACK, x_transferred
redhat.com /archives/fedora-package-announce/2008-September/msg00712.html · vendor-advisory, x_refsource_FEDORA, x_transferred
vupen.com /english/advisories/2008/2305 · vdb-entry, x_refsource_VUPEN, x_transferred
redhat.com /archives/fedora-package-announce/2008-September/msg00859.html · vendor-advisory, x_refsource_FEDORA, x_transferred
nvd.nist.gov /vuln/detail/CVE-2008-2370 · advisory
web.archive.org /web/20090201124638/http://secunia.com/advisories/32120 · web
web.archive.org /web/20090201124957/http://secunia.com/advisories/31982 · web
web.archive.org /web/20090201125002/http://secunia.com/advisories/32266 · web
web.archive.org /web/20090201141000/http://secunia.com/advisories/32222 · web
web.archive.org /web/20090207111236/http://secunia.com/advisories/33797 · web
web.archive.org /web/20090225175903/http://secunia.com/advisories/33999 · web
web.archive.org /web/20090228074535/http://secunia.com/advisories/31379 · web
web.archive.org /web/20090228074540/http://secunia.com/advisories/34013 · web
web.archive.org /web/20090308065055/http://secunia.com/advisories/31865 · web
web.archive.org /web/20090811003155/http://secunia.com/advisories/35393 · web
web.archive.org /web/20090828023853/http://secunia.com/advisories/36249 · web
web.archive.org /web/20100706231759/http://secunia.com/advisories/37460 · web
web.archive.org /web/20110714083521/http://www.securitytracker.com/id?1020623 · web
web.archive.org /web/20110714174318/http://www.securityfocus.com/bid/30494 · web
web.archive.org /web/20120719164745/http://www.securityfocus.com/archive/1/495022/100/0/threaded · web
web.archive.org /web/20120724210029/http://www.securityfocus.com/bid/31681 · web
web.archive.org /web/20140723000733/http://secunia.com/advisories/57126 · web
web.archive.org /web/20150621204350/http://www.securityfocus.com/archive/1/507985/100/0/threaded · web
github.com /apache/tomcat · package

Sources

CVE List: CVE-2008-2370
GitHub Advisory: GHSA-m8h8-6rvg-f4mg
NVD: CVE-2008-2370

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary