CVE-2008-2370: Path Traversal
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Other sources
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2370?
CVE-2008-2370 is considered a critical severity vulnerability, as it enables directory traversal attacks that can lead to unauthorized file access.
How do I fix CVE-2008-2370?
To fix CVE-2008-2370, update your Apache Tomcat to versions 4.1.38, 5.5.27, or 6.0.18 or later.
What versions of Apache Tomcat are affected by CVE-2008-2370?
CVE-2008-2370 affects Apache Tomcat versions 4.1.0 to 4.1.37, 5.5.0 to 5.5.26, and 6.0.0 to 6.0.16.
What types of attacks can be executed using CVE-2008-2370?
CVE-2008-2370 allows attackers to perform directory traversal attacks, enabling the reading of arbitrary files on the server.
Is there a patch available for CVE-2008-2370?
Yes, patches are available through updated versions of Apache Tomcat which can be downloaded from the official repository.