4.2 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.973 High
EPSS
Percentile
99.8%
Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.
It was discovered that request dispatchers did not properly normalize user
requests that have trailing query strings, allowing remote attackers to
send specially-crafted requests that would cause an information leak.
(CVE-2008-5515)
A flaw was found in the way the Tomcat AJP (Apache JServ Protocol)
connector processes AJP connections. An attacker could use this flaw to
send specially-crafted requests that would cause a temporary denial of
service. (CVE-2009-0033)
It was discovered that the error checking methods of certain authentication
classes did not have sufficient error checking, allowing remote attackers
to enumerate (via brute force methods) usernames registered with
applications running on Tomcat when FORM-based authentication was used.
(CVE-2009-0580)
It was discovered that web applications containing their own XML parsers
could replace the XML parser Tomcat uses to parse configuration files. A
malicious web application running on a Tomcat instance could read or,
potentially, modify the configuration and XML-based data of other web
applications deployed on the same Tomcat instance. (CVE-2009-0783)
Users of Tomcat should upgrade to these updated packages, which contain
backported patches to resolve these issues. Tomcat must be restarted for
this update to take effect.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 5 | src | tomcat6 | < 6.0.18-12.0.ep5.el5 | tomcat6-6.0.18-12.0.ep5.el5.src.rpm |
RedHat | 5 | noarch | tomcat6 | < 6.0.18-12.0.ep5.el5 | tomcat6-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-admin-webapps | < 6.0.18-12.0.ep5.el5 | tomcat6-admin-webapps-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-el-1.0-api | < 6.0.18-12.0.ep5.el5 | tomcat6-el-1.0-api-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-jsp-2.1-api | < 6.0.18-12.0.ep5.el5 | tomcat6-jsp-2.1-api-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-webapps | < 6.0.18-12.0.ep5.el5 | tomcat6-webapps-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-javadoc | < 6.0.18-12.0.ep5.el5 | tomcat6-javadoc-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-lib | < 6.0.18-12.0.ep5.el5 | tomcat6-lib-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-log4j | < 6.0.18-12.0.ep5.el5 | tomcat6-log4j-6.0.18-12.0.ep5.el5.noarch.rpm |
RedHat | 5 | noarch | tomcat6-servlet-2.5-api | < 6.0.18-12.0.ep5.el5 | tomcat6-servlet-2.5-api-6.0.18-12.0.ep5.el5.noarch.rpm |
4.2 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.973 High
EPSS
Percentile
99.8%