Path Traversal in Apache Tomcat

CVE-2008-2370

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct direc…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.527 (98.9th percentile) — read the EPSS interpretation.

Affected products

  • Apache Tomcat — versions 4.1.0, 4.1.1, 4.1.2
  • N/a — versions n/a

Weakness classification (CWE)

References