CVE-2009-0783

Published: Jun 5, 2009Modified: Apr 23, 2026

4.2

Vector

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Exploitability: 0.8 / Impact: 3.4

Source: NVD

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

Affected (3)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 4.1.0 to 4.1.39
Apache Tomcat	From 5.5.0 to 5.5.27
Apache Tomcat	From 6.0.0 to 6.0.18

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (94)

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=127420533226623&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=129070310906557&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=136485229118404&w=2

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/35685

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35788

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/37460

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42368

Source: secalert@redhat.com

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT4077

Source: secalert@redhat.com

Third Party Advisory

http://svn.apache.org/viewvc?rev=652592&view=rev

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?rev=681156&view=rev

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?rev=739522&view=rev

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?rev=781542&view=rev

Source: secalert@redhat.com

Patch

http://svn.apache.org/viewvc?rev=781708&view=rev

Source: secalert@redhat.com

Patch

http://tomcat.apache.org/security-4.html

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-5.html

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2011/dsa-2207

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:136

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:138

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/504090/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/35416

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022336

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1856

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/3316

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/3056

Source: secalert@redhat.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/51195

Source: secalert@redhat.com

VDB Entry

https://issues.apache.org/bugzilla/show_bug.cgi?id=29936

Source: secalert@redhat.com

Issue TrackingPatch

https://issues.apache.org/bugzilla/show_bug.cgi?id=45933

Source: secalert@redhat.com

Issue Tracking

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716

Source: secalert@redhat.com

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913

Source: secalert@redhat.com

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450

Source: secalert@redhat.com

Tool Signature

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html