QwikSec

Security Database

CVE

CWE

Training

CVE-2008-5515

Published: Jun 16, 2009

Modified: Aug 7, 2024

PUBLISHED

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://tomcat.apache.org/security-4.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_MANDRIVA

vdb-entry

x_refsource_VUPEN

FEDORA-2009-11356

vendor-advisory

x_refsource_FEDORA

vendor-advisory

x_refsource_DEBIAN

third-party-advisory

x_refsource_JVN

vendor-advisory

x_refsource_HP

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_VUPEN

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_HP

20090610 [SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability

mailing-list

x_refsource_BUGTRAQ

APPLE-SA-2010-03-29-1

vendor-advisory

x_refsource_APPLE

vdb-entry

x_refsource_BID

vdb-entry

x_refsource_VUPEN

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_VUPEN

20090608 [SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability

mailing-list

x_refsource_BUGTRAQ

vendor-advisory

x_refsource_MANDRIVA

20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components

mailing-list

x_refsource_BUGTRAQ

third-party-advisory

x_refsource_SECUNIA

http://tomcat.apache.org/security-6.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

http://support.apple.com/kb/HT4077

x_refsource_CONFIRM

SUSE-SR:2010:008

vendor-advisory

x_refsource_SUSE

FEDORA-2009-11374

vendor-advisory

x_refsource_FEDORA

oval:org.mitre.oval:def:6445

vdb-entry

signature

x_refsource_OVAL

third-party-advisory

x_refsource_SECUNIA

FEDORA-2009-11352

vendor-advisory

x_refsource_FEDORA

http://tomcat.apache.org/security-5.html

x_refsource_CONFIRM

http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html

x_refsource_CONFIRM

SUSE-SR:2009:012

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_MANDRIVA

vendor-advisory

x_refsource_SUNALERT

vendor-advisory

x_refsource_HP

oval:org.mitre.oval:def:10422

vdb-entry

signature

x_refsource_OVAL

oval:org.mitre.oval:def:19452

vdb-entry

signature

x_refsource_OVAL

vdb-entry

x_refsource_VUPEN

[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.