Oval Definition:	oval:org.mitre.oval:def:10422
Revision Date: 2013-04-29 Version: 12 Title: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. Description: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. Family: unix Class: vulnerability Status: ACCEPTED Reference(s): CVE-2008-5515 Platform(s): CentOS Linux 5 Oracle Linux 5 Red Hat Enterprise Linux 5 Product(s): Definition Synopsis RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 OR The operating system installed on the system is CentOS Linux 5.x OR Oracle Linux 5.x AND Configuration section tomcat5-servlet-2.4-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-jsp-2.0-api-javadoc is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-jasper-javadoc is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-servlet-2.4-api is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-webapps is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5 is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-jasper is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-jsp-2.0-api is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-server-lib is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-common-lib is earlier than 0:5.5.23-0jpp.7.el5_3.2 OR tomcat5-admin-webapps is earlier than 0:5.5.23-0jpp.7.el5_3.2
BACK