CVE-2008-2938: Path Traversal
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.18 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 5.5.27 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 4.1.39
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2938?
CVE-2008-2938 is classified as a critical severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2008-2938?
To mitigate CVE-2008-2938, upgrade your Apache Tomcat installation to version 6.0.18, 5.5.27, or 4.1.39.
What affected software is associated with CVE-2008-2938?
CVE-2008-2938 affects Apache Tomcat versions 4.1.0 to 4.1.37, 5.5.0 to 5.5.26, and 6.0.0 to 6.0.16.
What type of vulnerability is CVE-2008-2938?
CVE-2008-2938 is a directory traversal vulnerability that enables attackers to read arbitrary files on the server.
Can I prevent CVE-2008-2938 if I disable allowLinking and UTF-8?
Disabling allowLinking and UTF-8 may reduce the risk, but upgrading to a secure version is the recommended solution.