CVE-2008-5515
Summary
| CVE | CVE-2008-5515 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-06-16 21:00:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | 4.1.0 | All | All | All |
| Application | Apache | Tomcat | 4.1.1 | All | All | All |
| Application | Apache | Tomcat | 4.1.10 | All | All | All |
| Application | Apache | Tomcat | 4.1.11 | All | All | All |
| Application | Apache | Tomcat | 4.1.12 | All | All | All |
| Application | Apache | Tomcat | 4.1.13 | All | All | All |
| Application | Apache | Tomcat | 4.1.14 | All | All | All |
| Application | Apache | Tomcat | 4.1.15 | All | All | All |
| Application | Apache | Tomcat | 4.1.16 | All | All | All |
| Application | Apache | Tomcat | 4.1.17 | All | All | All |
| Application | Apache | Tomcat | 4.1.18 | All | All | All |
| Application | Apache | Tomcat | 4.1.19 | All | All | All |
| Application | Apache | Tomcat | 4.1.2 | All | All | All |
| Application | Apache | Tomcat | 4.1.20 | All | All | All |
| Application | Apache | Tomcat | 4.1.21 | All | All | All |
| Application | Apache | Tomcat | 4.1.22 | All | All | All |
| Application | Apache | Tomcat | 4.1.23 | All | All | All |
| Application | Apache | Tomcat | 4.1.24 | All | All | All |
| Application | Apache | Tomcat | 4.1.25 | All | All | All |
| Application | Apache | Tomcat | 4.1.26 | All | All | All |
| Application | Apache | Tomcat | 4.1.27 | All | All | All |
| Application | Apache | Tomcat | 4.1.28 | All | All | All |
| Application | Apache | Tomcat | 4.1.29 | All | All | All |
| Application | Apache | Tomcat | 4.1.3 | All | All | All |
| Application | Apache | Tomcat | 4.1.30 | All | All | All |
| Application | Apache | Tomcat | 4.1.31 | All | All | All |
| Application | Apache | Tomcat | 4.1.32 | All | All | All |
| Application | Apache | Tomcat | 4.1.33 | All | All | All |
| Application | Apache | Tomcat | 4.1.34 | All | All | All |
| Application | Apache | Tomcat | 4.1.35 | All | All | All |
| Application | Apache | Tomcat | 4.1.36 | All | All | All |
| Application | Apache | Tomcat | 4.1.37 | All | All | All |
| Application | Apache | Tomcat | 4.1.38 | All | All | All |
| Application | Apache | Tomcat | 4.1.39 | All | All | All |
| Application | Apache | Tomcat | 5.5.0 | All | All | All |
| Application | Apache | Tomcat | 5.5.1 | All | All | All |
| Application | Apache | Tomcat | 5.5.10 | All | All | All |
| Application | Apache | Tomcat | 5.5.11 | All | All | All |
| Application | Apache | Tomcat | 5.5.12 | All | All | All |
| Application | Apache | Tomcat | 5.5.13 | All | All | All |
| Application | Apache | Tomcat | 5.5.14 | All | All | All |
| Application | Apache | Tomcat | 5.5.15 | All | All | All |
| Application | Apache | Tomcat | 5.5.16 | All | All | All |
| Application | Apache | Tomcat | 5.5.17 | All | All | All |
| Application | Apache | Tomcat | 5.5.18 | All | All | All |
| Application | Apache | Tomcat | 5.5.19 | All | All | All |
| Application | Apache | Tomcat | 5.5.2 | All | All | All |
| Application | Apache | Tomcat | 5.5.20 | All | All | All |
| Application | Apache | Tomcat | 5.5.21 | All | All | All |
| Application | Apache | Tomcat | 5.5.22 | All | All | All |
| Application | Apache | Tomcat | 5.5.23 | All | All | All |
| Application | Apache | Tomcat | 5.5.24 | All | All | All |
| Application | Apache | Tomcat | 5.5.25 | All | All | All |
| Application | Apache | Tomcat | 5.5.26 | All | All | All |
| Application | Apache | Tomcat | 5.5.27 | All | All | All |
| Application | Apache | Tomcat | 5.5.3 | All | All | All |
| Application | Apache | Tomcat | 5.5.4 | All | All | All |
| Application | Apache | Tomcat | 5.5.5 | All | All | All |
| Application | Apache | Tomcat | 5.5.6 | All | All | All |
| Application | Apache | Tomcat | 5.5.7 | All | All | All |
| Application | Apache | Tomcat | 5.5.8 | All | All | All |
| Application | Apache | Tomcat | 5.5.9 | All | All | All |
| Application | Apache | Tomcat | 6.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.1 | All | All | All |
| Application | Apache | Tomcat | 6.0.10 | All | All | All |
| Application | Apache | Tomcat | 6.0.12 | All | All | All |
| Application | Apache | Tomcat | 6.0.13 | All | All | All |
| Application | Apache | Tomcat | 6.0.14 | All | All | All |
| Application | Apache | Tomcat | 6.0.15 | All | All | All |
| Application | Apache | Tomcat | 6.0.16 | All | All | All |
| Application | Apache | Tomcat | 6.0.17 | All | All | All |
| Application | Apache | Tomcat | 6.0.18 | All | All | All |
| Application | Apache | Tomcat | 6.0.2 | All | All | All |
| Application | Apache | Tomcat | 6.0.3 | All | All | All |
| Application | Apache | Tomcat | 6.0.4 | All | All | All |
| Application | Apache | Tomcat | 6.0.5 | All | All | All |
| Application | Apache | Tomcat | 6.0.6 | All | All | All |
| Application | Apache | Tomcat | 6.0.7 | All | All | All |
| Application | Apache | Tomcat | 6.0.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Fujitsu Interstage Products Information Disclosure Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| '[security bulletin] HPSBUX02579 SSRT100203 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| VMware Products Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-2207-1 tomcat5.5 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| '[security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Acces' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| SUSE Update for Multiple Packages - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| JVN#63832775 Apache Tomcat information disclosure vulnerability | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | Patch |
| Apache Tomcat® - Apache Tomcat 4.x vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Patch, Vendor Advisory |
| HP-UX update for Tomcat Servlet Engine - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 11 Update: tomcat6-6.0.20-1.fc11 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [SECURITY] Fedora 10 Update: tomcat6-6.0.20-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| '[security bulletin] HPSBUX02860 SSRT101146 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| This page provides Security Information. : Fujitsu Global | af854a3a-2127-422b-91ae-364da2661108 | www.fujitsu.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| BlackBerry Enterprise Server Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Sun Solaris Tomcat Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2010:008 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| [SECURITY] Fedora 12 Update: tomcat6-6.0.20-1.fc12 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Patch, Vendor Advisory |
| APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Apache Tomcat - Apache Tomcat 5 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Patch, Vendor Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| About the security content of Security Update 2010-002 / Mac OS X v10.6.3 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Apache Tomcat® - Apache Tomcat 6 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Patch, Vendor Advisory |
| VMSA-2009-0016.1 | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | |
| SUSE Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:012 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.