CVE-2013-0346: Low severity tomcat vulnerability
DISPUTED Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."
Other sources
Agostino Sarubbo reported on the oss-security mailing list [1] that, on Gentoo, Tomcat 7's log directory is world-accessible and the log files inside the directory are world-readable. This could allow an unprivileged user to read the log files.
References: [1] http://www.openwall.com/lists/oss-security/2013/02/22/15 [2] http://www.openwall.com/lists/oss-security/2013/02/23/5
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0346?
The severity of CVE-2013-0346 is generally regarded as low due to the lack of sensitive data in the affected logs.
How do I fix CVE-2013-0346?
To fix CVE-2013-0346, update to a version of Apache Tomcat where the log directory permissions have been secured.
Which versions are affected by CVE-2013-0346?
CVE-2013-0346 affects multiple versions of Apache Tomcat 7.x, specifically from 7.0.0 up to 7.0.50.
Can local users exploit CVE-2013-0346?
Yes, local users can potentially exploit CVE-2013-0346 to read log files due to world-readable permissions.
Is sensitive information stored in the Tomcat logs for CVE-2013-0346?
According to some statements, the Tomcat log directory does not typically contain sensitive information, which reduces the impact of CVE-2013-0346.