CVE-2008-2938: Path Traversal
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2938?
CVE-2008-2938 is classified as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2008-2938?
To mitigate CVE-2008-2938, upgrade your Apache Tomcat installation to version 6.0.18, 5.5.27, or 4.1.39.
What affected software is associated with CVE-2008-2938?
CVE-2008-2938 affects Apache Tomcat versions 4.1.0 to 4.1.37, 5.5.0 to 5.5.26, and 6.0.0 to 6.0.16.
What type of vulnerability is CVE-2008-2938?
CVE-2008-2938 is a directory traversal vulnerability that enables attackers to read arbitrary files on the server.
Can I prevent CVE-2008-2938 if I disable allowLinking and UTF-8?
Disabling allowLinking and UTF-8 may reduce the risk, but upgrading to a secure version is the recommended solution.