Ubuntu.comUB:CVE-2008-5515CVE-2008-5515
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.004 Low
EPSS
Percentile
73.1%
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through
6.0.18, and possibly earlier versions normalizes the target pathname before
filtering the query string when using the RequestDispatcher method, which
allows remote attackers to bypass intended access restrictions and conduct
directory traversal attacks via … (dot dot) sequences and the WEB-INF
directory in a Request.
Notes
| Author | Note |
|---|---|
| mdeslaur | example PoC: http://seclists.org/bugtraq/2009/Jun/0086.html |
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.004 Low
EPSS
Percentile
73.1%