NVD

Id
2289  
Name
CVE-2008-2370  
Description
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-08-03  
Modified Date
2014-03-15  
Seq
2008-2370  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
14663 2289 CVE-2008-2370 APPLE-SA-2008-10-09  View
14664 2289 CVE-2008-2370 SUSE-SR:2008:018  View
14665 2289 CVE-2008-2370 SUSE-SR:2009:004  View
14666 2289 CVE-2008-2370 [ode-user] 20090808 [ANNOUNCE] Apache ODE 1.3.3  View
14667 2289 CVE-2008-2370 [apache-announce] 20090808 [ANNOUNCE] Apache ODE 1.3.3  View
14668 2289 CVE-2008-2370 SSRT090005  View
14669 2289 CVE-2008-2370 HPSBST02955  View
14670 2289 CVE-2008-2370 oval:org.mitre.oval:def:10577  View
14671 2289 CVE-2008-2370 oval:org.mitre.oval:def:5876  View
14672 2289 CVE-2008-2370 4099  View
14673 2289 CVE-2008-2370 http://support.apple.com/kb/HT3216  View
14674 2289 CVE-2008-2370 http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm  View
14675 2289 CVE-2008-2370 http://tomcat.apache.org/security-4.html  View
14676 2289 CVE-2008-2370 http://tomcat.apache.org/security-5.html  View
14677 2289 CVE-2008-2370 http://tomcat.apache.org/security-6.html  View
14678 2289 CVE-2008-2370 http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html  View
14679 2289 CVE-2008-2370 MDVSA-2008:188  View
14680 2289 CVE-2008-2370 RHSA-2008:0648  View
14681 2289 CVE-2008-2370 RHSA-2008:0862  View
14682 2289 CVE-2008-2370 RHSA-2008:0864  View
14683 2289 CVE-2008-2370 20080801 [CVE-2008-2370] Apache Tomcat information disclosure vulnerability  View
14684 2289 CVE-2008-2370 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components  View
14685 2289 CVE-2008-2370 30494  View
14686 2289 CVE-2008-2370 31681  View
14687 2289 CVE-2008-2370 1020623  View
14688 2289 CVE-2008-2370 http://www.vmware.com/security/advisories/VMSA-2009-0002.html  View
14689 2289 CVE-2008-2370 http://www.vmware.com/security/advisories/VMSA-2009-0016.html  View
14690 2289 CVE-2008-2370 ADV-2008-2305  View
14691 2289 CVE-2008-2370 ADV-2008-2780  View
14692 2289 CVE-2008-2370 ADV-2008-2823  View
14693 2289 CVE-2008-2370 ADV-2009-0320  View
14694 2289 CVE-2008-2370 ADV-2009-0503  View
14695 2289 CVE-2008-2370 ADV-2009-1535  View
14696 2289 CVE-2008-2370 ADV-2009-2215  View
14697 2289 CVE-2008-2370 ADV-2009-3316  View
14698 2289 CVE-2008-2370 tomcat-requestdispatcher-info-disclosure(44156)  View
14699 2289 CVE-2008-2370 FEDORA-2008-7977  View
14700 2289 CVE-2008-2370 FEDORA-2008-8113  View
14701 2289 CVE-2008-2370 FEDORA-2008-8130  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46296 JVNDB-2008-001606 Apache Tomcat の RequestDispatcher に関するディレクトリトラバーサルの脆弱性 Apache Tomcat は RequestDispatcher を使用している場合、URI からのクエリ文字列を削除する前にパスの正常化が動作するため、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2008-2370 32483 CVE-2008-2370 2289 5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001606.html 2008-08-03 2015-03-26 View