VulnerabilityModified
CVE-2009-2902
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
MEDIUM 4.3EPSS 10.8%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 10.8%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 10.78% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- apache/tomcat
- Source
- secalert@redhat.com
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- http://marc.info/?l=bugtraq&m=127420533226623&w=2
- http://marc.info/?l=bugtraq&m=133469267822771&w=2
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- http://marc.info/?l=bugtraq&m=139344343412337&w=2
- http://secunia.com/advisories/38316Vendor Advisory
- http://secunia.com/advisories/38346
- http://secunia.com/advisories/38541
- http://secunia.com/advisories/38687
- http://secunia.com/advisories/39317
- http://secunia.com/advisories/40330
- http://secunia.com/advisories/40813
- http://secunia.com/advisories/43310
- http://secunia.com/advisories/57126
- http://securitytracker.com/id?1023504
- http://support.apple.com/kb/HT4077
- http://svn.apache.org/viewvc?rev=892815&view=rev
- http://svn.apache.org/viewvc?rev=902650&view=rev
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://ubuntu.com/usn/usn-899-1
- http://www.debian.org/security/2011/dsa-2207
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:176
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:177
- http://www.redhat.com/support/errata/RHSA-2010-0119.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.