CVE-2007-5461

Published: Oct 15, 2007Modified: Apr 23, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

Affected (44)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 4.0.0
Apache Tomcat	Version 4.0.1
Apache Tomcat	Version 4.0.2
Apache Tomcat	Version 4.0.3
Apache Tomcat	Version 4.0.4
Apache Tomcat	Version 4.0.5
Apache Tomcat	Version 4.0.6
Apache Tomcat	Version 4.1.0
Apache Tomcat	Version 4.1.10
Apache Tomcat	Version 4.1.11
Apache Tomcat	Version 4.1.12
Apache Tomcat	Version 4.1.13
Apache Tomcat	Version 4.1.14
Apache Tomcat	Version 4.1.15
Apache Tomcat	Version 4.1.16
Apache Tomcat	Version 4.1.17
Apache Tomcat	Version 4.1.18
Apache Tomcat	Version 4.1.19
Apache Tomcat	Version 4.1.1
Apache Tomcat	Version 4.1.20
Apache Tomcat	Version 4.1.21
Apache Tomcat	Version 4.1.22
Apache Tomcat	Version 4.1.23
Apache Tomcat	Version 4.1.24
Apache Tomcat	Version 4.1.25
Apache Tomcat	Version 4.1.26
Apache Tomcat	Version 4.1.27
Apache Tomcat	Version 4.1.28
Apache Tomcat	Version 4.1.29
Apache Tomcat	Version 4.1.2
Apache Tomcat	Version 4.1.30
Apache Tomcat	Version 4.1.31
Apache Tomcat	Version 4.1.32
Apache Tomcat	Version 4.1.33
Apache Tomcat	Version 4.1.34
Apache Tomcat	Version 4.1.35
Apache Tomcat	Version 4.1.36
Apache Tomcat	Version 4.1.3
Apache Tomcat	Version 4.1.4
Apache Tomcat	Version 4.1.5
Apache Tomcat	Version 4.1.6
Apache Tomcat	Version 4.1.7
Apache Tomcat	Version 4.1.8
Apache Tomcat	Version 4.1.9

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (144)

http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html

Source: secalert@redhat.com

http://issues.apache.org/jira/browse/GERONIMO-3549

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://marc.info/?l=full-disclosure&m=119239530508382

Source: secalert@redhat.com

Exploit

http://rhn.redhat.com/errata/RHSA-2008-0630.html

Source: secalert@redhat.com

http://secunia.com/advisories/27398

Source: secalert@redhat.com

http://secunia.com/advisories/27446

Source: secalert@redhat.com

http://secunia.com/advisories/27481

Source: secalert@redhat.com

http://secunia.com/advisories/27727

Source: secalert@redhat.com

http://secunia.com/advisories/28317

Source: secalert@redhat.com

http://secunia.com/advisories/28361

Source: secalert@redhat.com

http://secunia.com/advisories/29242

Source: secalert@redhat.com

http://secunia.com/advisories/29313

Source: secalert@redhat.com

http://secunia.com/advisories/29711

Source: secalert@redhat.com

http://secunia.com/advisories/30676

Source: secalert@redhat.com

http://secunia.com/advisories/30802

Source: secalert@redhat.com

http://secunia.com/advisories/30899

Source: secalert@redhat.com

http://secunia.com/advisories/30908

Source: secalert@redhat.com

http://secunia.com/advisories/31493

Source: secalert@redhat.com

http://secunia.com/advisories/32120

Source: secalert@redhat.com

http://secunia.com/advisories/32222

Source: secalert@redhat.com

http://secunia.com/advisories/32266

Source: secalert@redhat.com

http://secunia.com/advisories/37460

Source: secalert@redhat.com

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200804-10.xml

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1

Source: secalert@redhat.com

http://support.apple.com/kb/HT2163

Source: secalert@redhat.com

http://support.apple.com/kb/HT3216

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm

Source: secalert@redhat.com

http://tomcat.apache.org/security-4.html

Source: secalert@redhat.com

http://tomcat.apache.org/security-5.html

Source: secalert@redhat.com

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

http://www-1.ibm.com/support/docview.wss?uid=swg21286112

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1447

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1453

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:241

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0042.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0195.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0862.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/26070

Source: secalert@redhat.com

http://www.securityfocus.com/bid/31681

Source: secalert@redhat.com

http://www.securitytracker.com/id?1018864

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2008-0010.html

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/3622

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/3671

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/3674

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/1856/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/1979/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/1981/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/2780

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/2823

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3316

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/37243

Source: secalert@redhat.com

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202

Source: secalert@redhat.com

https://www.exploit-db.com/exploits/4530

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Source: secalert@redhat.com

http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html