CVE - CVE-2007-5461

CVE-ID
CVE-2007-5461	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components URL:http://www.securityfocus.com/archive/1/507985/100/0/threaded FULLDISC:20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay URL:http://marc.info/?l=full-disclosure&m=119239530508382 EXPLOIT-DB:4530 URL:https://www.exploit-db.com/exploits/4530 MLIST:[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet URL:http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3E MISC:http://issues.apache.org/jira/browse/GERONIMO-3549 CONFIRM:http://tomcat.apache.org/security-4.html CONFIRM:http://tomcat.apache.org/security-5.html CONFIRM:http://tomcat.apache.org/security-6.html CONFIRM:http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html CONFIRM:http://www-1.ibm.com/support/docview.wss?uid=swg21286112 CONFIRM:http://www.vmware.com/security/advisories/VMSA-2008-0010.html CONFIRM:http://support.apple.com/kb/HT2163 CONFIRM:http://support.apple.com/kb/HT3216 CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm CONFIRM:http://www.vmware.com/security/advisories/VMSA-2009-0016.html APPLE:APPLE-SA-2008-06-30 URL:http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html APPLE:APPLE-SA-2008-10-09 URL:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html DEBIAN:DSA-1447 URL:http://www.debian.org/security/2008/dsa-1447 DEBIAN:DSA-1453 URL:http://www.debian.org/security/2008/dsa-1453 FEDORA:FEDORA-2007-3456 URL:https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html GENTOO:GLSA-200804-10 URL:http://security.gentoo.org/glsa/glsa-200804-10.xml HP:HPSBST02955 URL:http://marc.info/?l=bugtraq&m=139344343412337&w=2 MANDRIVA:MDKSA-2007:241 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 MANDRIVA:MDVSA-2009:136 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:136 REDHAT:RHSA-2008:0042 URL:http://www.redhat.com/support/errata/RHSA-2008-0042.html REDHAT:RHSA-2008:0195 URL:http://www.redhat.com/support/errata/RHSA-2008-0195.html REDHAT:RHSA-2008:0261 URL:http://www.redhat.com/support/errata/RHSA-2008-0261.html REDHAT:RHSA-2008:0630 URL:http://rhn.redhat.com/errata/RHSA-2008-0630.html REDHAT:RHSA-2008:0862 URL:http://www.redhat.com/support/errata/RHSA-2008-0862.html SUNALERT:239312 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 SUSE:SUSE-SR:2008:005 URL:http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html SUSE:SUSE-SR:2009:004 URL:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html BID:26070 URL:http://www.securityfocus.com/bid/26070 BID:31681 URL:http://www.securityfocus.com/bid/31681 OVAL:oval:org.mitre.oval:def:9202 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202 SECUNIA:37460 URL:http://secunia.com/advisories/37460 SECUNIA:57126 URL:http://secunia.com/advisories/57126 VUPEN:ADV-2007-3622 URL:http://www.vupen.com/english/advisories/2007/3622 VUPEN:ADV-2007-3671 URL:http://www.vupen.com/english/advisories/2007/3671 VUPEN:ADV-2007-3674 URL:http://www.vupen.com/english/advisories/2007/3674 VUPEN:ADV-2008-1856 URL:http://www.vupen.com/english/advisories/2008/1856/references VUPEN:ADV-2008-1981 URL:http://www.vupen.com/english/advisories/2008/1981/references VUPEN:ADV-2008-1979 URL:http://www.vupen.com/english/advisories/2008/1979/references VUPEN:ADV-2008-2823 URL:http://www.vupen.com/english/advisories/2008/2823 VUPEN:ADV-2008-2780 URL:http://www.vupen.com/english/advisories/2008/2780 SECTRACK:1018864 URL:http://www.securitytracker.com/id?1018864 SECUNIA:27398 URL:http://secunia.com/advisories/27398 SECUNIA:27446 URL:http://secunia.com/advisories/27446 SECUNIA:27481 URL:http://secunia.com/advisories/27481 SECUNIA:27727 URL:http://secunia.com/advisories/27727 SECUNIA:28317 URL:http://secunia.com/advisories/28317 SECUNIA:28361 URL:http://secunia.com/advisories/28361 SECUNIA:29242 URL:http://secunia.com/advisories/29242 SECUNIA:29313 URL:http://secunia.com/advisories/29313 SECUNIA:29711 URL:http://secunia.com/advisories/29711 SECUNIA:30676 URL:http://secunia.com/advisories/30676 SECUNIA:30802 URL:http://secunia.com/advisories/30802 SECUNIA:30908 URL:http://secunia.com/advisories/30908 SECUNIA:30899 URL:http://secunia.com/advisories/30899 SECUNIA:31493 URL:http://secunia.com/advisories/31493 SECUNIA:32222 URL:http://secunia.com/advisories/32222 SECUNIA:32120 URL:http://secunia.com/advisories/32120 SECUNIA:32266 URL:http://secunia.com/advisories/32266 VUPEN:ADV-2009-3316 URL:http://www.vupen.com/english/advisories/2009/3316 XF:apache-tomcat-webdav-dir-traversal(37243) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/37243
Assigning CNA
N/A
Date Entry Created
20071015	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20071015)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org