Patchfirst
Patchfirst
CVE-2007-0450 Public exploit EPSS 91.2%

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using…

Summary

The flaw is a directory traversal vulnerability in Apache HTTP Server and Tomcat (5.x before 5.5.22 and 6.x before 6.0.10) when certain proxy modules, namely mod_proxy, mod_rewrite, and mod_jk, are in use, where dot-dot sequences combined with forward slashes, backslashes, or URL-encoded backslashes (%5C) are interpreted differently by Tomcat than by Apache.

Official description · CVE.org

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Breakdown
25.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Exploit-DB) was available 2 days before disclosure.

  1. Public exploit codeExploit-DB2 days before
  2. Disclosedday 0

2 related vulnerabilities in the same code over 2 months. The latest fix listed for tomcat is 6.0.16.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2007-0450Directory traversal vulnerability in Apache HTTP Server and…16 Mar 2007
  2. relatedLow

    Why these are linked:

    • Stated in the CVE text…er before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
    CVE-2007-1860mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before…25 May 2007

Fixes in tomcatMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.5.17CVE-2006-383525 Jul 2006
  2. 5.5.18CVE-2006-71959 May 2007
  3. 5.5.21CVE-2008-430826 Feb 2009
  4. 6.0.10CVE-2007-045016 Mar 2007
  5. 6.0.14CVE-2007-245014 Jun 2007
  6. 6.0.15CVE-2007-533312 Feb 2008
  7. 6.0.16CVE-2008-000212 Feb 2008Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-4prh-gqw8-rgh5

Upgrade to 6.0.35 or later

Fixes this CVE and 8 other known vulnerabilities in this package (CVE-2007-2449, CVE-2007-5333, +6).

Set the version to 6.0.35 or later in your pom.xml or build.gradle.

First fixed in 6.0.10 for CVE-2007-0450.

Affected versions, by release line

If you runUpgrade to
6.0 up to 6.0.106.0.35first fix for this CVE: 6.0.10
5.0 up to 5.5.225.5.35first fix for this CVE: 5.5.22

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

56 links, grouped by NVD tag

x_refsource_CONFIRM 8

tomcat.apache.org/security-4.htmlsupport.avaya.com/elmodocs2/security/ASA-2007-206.htmtomcat.apache.org/security-6.htmldocs.info.apple.com/article.html?artnum=306172tomcat.apache.org/security-5.htmlfujitsu.com/global/support/software/security/products-f/interstage-200702e.htmlcommunity.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspxsupport.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

third-party-advisory 11

secunia.com/advisories/30908secunia.com/advisories/30899secunia.com/advisories/33668secunia.com/advisories/25280secunia.com/advisories/24732secunia.com/advisories/28365secunia.com/advisories/27037secunia.com/advisories/26660
Show 3 moreShow fewersecunia.com/advisories/25106securityreason.com/securityalert/2446secunia.com/advisories/26235

mailing-list 14

lists.vmware.com/pipermail/security-announce/2008/000003.htmlsecurityfocus.com/archive/1/500412/100/0/threadedsecurityfocus.com/archive/1/485938/100/0/threadedsecurityfocus.com/archive/1/500396/100/0/threadedsecurityfocus.com/archive/1/462791/100/0/threadedlists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E
Show 6 moreShow fewerlists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E

vdb-entry 11

vupen.com/english/advisories/2007/2732vupen.com/english/advisories/2007/3087exchange.xforce.ibmcloud.com/vulnerabilities/32988vupen.com/english/advisories/2008/1979/referencesvupen.com/english/advisories/2008/0065vupen.com/english/advisories/2009/0233securityfocus.com/bid/22960vupen.com/english/advisories/2007/3386
Show 3 moreShow fewervupen.com/english/advisories/2007/0975securityfocus.com/bid/25159oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10643

vendor-advisory 10

sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1novell.com/linux/security/advisories/2007_5_sr.htmllists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlredhat.com/support/errata/RHSA-2007-0360.htmlredhat.com/support/errata/RHSA-2007-0327.htmlh20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795redhat.com/support/errata/RHSA-2008-0261.htmlsecurity.gentoo.org/glsa/glsa-200705-03.xmlmandriva.com/security/advisories?name=MDKSA-2007:241novell.com/linux/security/advisories/2007_15_sr.html

x_refsource_MISC 2

sec-consult.com/287.htmlsec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt
↑ ↓ chooseEnter openEsc close