« Volver al listado

CVE-2007-5461

Estado: ModificadaBaja (3.5)—💥 Exploit

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Apache — Tomcat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5461",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-15T18:17:00.000",
  "references": [
    {
      "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://issues.apache.org/jira/browse/GERONIMO-3549",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=139344343412337&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119239530508382",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27398",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27446",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27481",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27727",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28317",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28361",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/29242",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/29313",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/29711",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/30676",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/30802",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/30899",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/30908",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/31493",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/32120",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/32222",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/32266",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/37460",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/57126",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://support.apple.com/kb/HT2163",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://support.apple.com/kb/HT3216",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://tomcat.apache.org/security-4.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://tomcat.apache.org/security-5.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://tomcat.apache.org/security-6.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1447",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1453",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/26070",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/31681",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1018864",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3622",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3671",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3674",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1856/references",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1979/references",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1981/references",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2780",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2823",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3316",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4530",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://issues.apache.org/jira/browse/GERONIMO-3549",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=139344343412337&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119239530508382",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27398",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27446",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27481",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27727",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28317",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28361",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29242",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29313",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29711",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30676",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30802",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30899",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30908",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31493",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32120",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32222",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32266",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37460",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/57126",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT2163",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT3216",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tomcat.apache.org/security-4.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tomcat.apache.org/security-5.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tomcat.apache.org/security-6.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1447",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1453",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26070",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31681",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1018864",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3622",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3671",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3674",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1856/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1979/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/1981/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2780",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/2823",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3316",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4530",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de ruta absoluta en Apache Tomcat 4.0.0 hasta la versión 4.0.6, 4.1.0, 5.0.0, 5.5.0 hasta la versión 5.5.25 y 6.0.0 hasta la versión 6.0.14, bajo determinadas configuraciones, permite a usuarios remotos autenticados leer archivos arbitrarios a través de una petición de escritura WebDAV que especifica una entidad con una etiqueta SYSTEM."
    }
  ],
  "lastModified": "2026-06-16T22:46:11.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "914E1404-01A2-4F94-AA40-D5EA20F55AD3"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81FB1106-B26D-45BE-A511-8E69131BBA52"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "401A213A-FED3-49C0-B823-2E02EA528905"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BFE5AD8-DB14-4632-9D2A-F2013579CA7D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7641278D-3B8B-4CD2-B284-2047B65514A2"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB7B9911-E836-4A96-A0E8-D13C957EC0EE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2341C51-A239-4A4A-B0DC-30F18175442C"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E300013-0CE7-4313-A553-74A6A247B3E9"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E08D7414-8D0C-45D6-8E87-679DF0201D55"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB15C5DB-0DBE-4DAD-ACBD-FAE23F768D01"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60CFD9CA-1878-4C74-A9BD-5D581736E6B6"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02860646-1D72-4D9A-AE2A-5868C8EDB3AA"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BE4B9B5-9C2E-47E1-9483-88A17264594F"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BE92A9B-4B8C-468E-9162-A56ED5313E17"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE21D455-5B38-4B07-8E25-4EE782501EB3"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9AE125C-EB8E-4D33-BB64-1E2AEE18BF81"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47588ABB-FCE6-478D-BEAD-FC9A0C7D66DF"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C92F3744-C8F9-4E29-BF1A-25E03A32F2C0"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "084B3227-FE22-43E3-AE06-7BB257018690"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7DDA1D1-1DB2-4FD6-90A6-7DDE2FDD73F4"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2BFF1D5-2E34-4A01-83A7-6AA3A112A1B2"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D536FF4-7582-4351-ABE3-876E20F8E7FE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C03E4C9-34E3-42F7-8B73-D3C595FD7EE1"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB43F47F-5BF9-43A0-BF0E-451B4A8F7137"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFFFE700-AAFE-4F5B-B0E2-C3DA76DE492D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11DDD82E-5D83-4581-B2F3-F12655BBF817"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A0F0C91-171E-421D-BE86-11567DEFC7BD"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F22D2621-D305-43CE-B00D-9A7563B061F7"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A5D55E8-D3A3-4784-8AC6-CCB07E470AB2"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F4245BA-B05C-49DE-B2E0-1E588209ED3B"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8633532B-9785-4259-8840-B08529E20DCC"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1D9BD7E-FCC2-404B-A057-1A10997DAFF9"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F935ED72-58F4-49C1-BD9F-5473E0B9D8CE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FADB75DC-8713-4F0C-9F06-30DA6F6EF6B8"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EA52901-2D16-4F7E-BF5E-780B42A55D6A"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A79DA2C-35F3-47DE-909B-8D8D1AE111C8"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BF6952D-6308-4029-8B63-0BD9C648C60F"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94941F86-0BBF-4F30-8F13-FB895A11ED69"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17522878-4266-432A-859D-C02096C8AC0E"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "951FFCD7-EAC2-41E6-A53B-F90C540327E8"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF1F2738-C7D6-4206-9227-43F464887FF5"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98EEB6F2-A721-45CF-A856-0E01B043C317"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02FDE602-A56A-477E-B704-41AF92EEBB9D"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A28B11A-3BC7-41BC-8970-EE075B029F5C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}