Apache Tomcat Path Traversal Vulnerability
Moderate severity
GitHub Reviewed
Published
May 1, 2022
to the GitHub Advisory Database
•
Updated Feb 9, 2024
Package
Affected versions
>= 4.1.0, <= 4.1.37
>= 5.5.0, <= 5.5.26
>= 6.0.0, <= 6.0.16
Patched versions
4.1.38
5.5.27
6.0.18
Description
Published by the National Vulnerability Database
Aug 4, 2008
Published to the GitHub Advisory Database
May 1, 2022
Reviewed
Feb 9, 2024
Last updated
Feb 9, 2024
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a
RequestDispatcheris used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a..(dot dot) in a request parameter.References