[Forgot Password]
Login  Register Subscribe

24128

 
 

131573

 
 

110139

 
 

909

 
 

85964

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2007-0450Date: (C)2007-03-16   (M)2018-02-19


Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 5.0
Exploit Score: Exploit Score: 10.0
Impact Score: Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: LOW
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: PARTIAL
Scope: Integrity: NONE
Confidentiality: Availability: NONE
Integrity:  
Availability:  
  
Reference:
http://www.securityfocus.com/archive/1/archive/1/462791/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/485938/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
BID-22960
SUNALERT-239312
SREASON-2446
SECUNIA-24732
SECUNIA-25106
BID-25159
SECUNIA-25280
SECUNIA-26235
SECUNIA-26660
SECUNIA-27037
SECUNIA-28365
SECUNIA-30899
SECUNIA-30908
SECUNIA-33668
ADV-2007-0975
ADV-2007-2732
ADV-2007-3087
ADV-2007-3386
ADV-2008-0065
ADV-2008-1979
ADV-2009-0233
APPLE-SA-2007-07-31
GLSA-200705-03
HPSBUX02262
MDKSA-2007:241
RHSA-2007:0327
RHSA-2007:0360
RHSA-2008:0261
SSRT071447
SUSE-SR:2007:005
SUSE-SR:2007:015
http://lists.vmware.com/pipermail/security-announce/2008/000003.html
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://docs.info.apple.com/article.html?artnum=306172
http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.html
http://www.sec-consult.com/287.html
http://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt
tomcat-proxy-directory-traversal(32988)

CPE    26
cpe:/a:apache:tomcat:5.0.19
cpe:/a:apache:tomcat:5.0.28
cpe:/a:apache:tomcat:5.5.3
cpe:/a:apache:tomcat:5.5.2
...
CWE    1
CWE-22

© SecPod Technologies