CVE - CVE-2007-5461

CVE-ID
CVE-2007-5461	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
APPLE:APPLE-SA-2008-06-30 URL:http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html APPLE:APPLE-SA-2008-10-09 URL:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html BID:26070 URL:http://www.securityfocus.com/bid/26070 BID:31681 URL:http://www.securityfocus.com/bid/31681 BUGTRAQ:20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components URL:http://www.securityfocus.com/archive/1/507985/100/0/threaded CONFIRM:http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html CONFIRM:http://support.apple.com/kb/HT2163 CONFIRM:http://support.apple.com/kb/HT3216 CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm CONFIRM:http://tomcat.apache.org/security-4.html CONFIRM:http://tomcat.apache.org/security-5.html CONFIRM:http://tomcat.apache.org/security-6.html CONFIRM:http://www-1.ibm.com/support/docview.wss?uid=swg21286112 CONFIRM:http://www.vmware.com/security/advisories/VMSA-2008-0010.html CONFIRM:http://www.vmware.com/security/advisories/VMSA-2009-0016.html DEBIAN:DSA-1447 URL:http://www.debian.org/security/2008/dsa-1447 DEBIAN:DSA-1453 URL:http://www.debian.org/security/2008/dsa-1453 EXPLOIT-DB:4530 URL:https://www.exploit-db.com/exploits/4530 FEDORA:FEDORA-2007-3456 URL:https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html FULLDISC:20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay URL:http://marc.info/?l=full-disclosure&m=119239530508382 GENTOO:GLSA-200804-10 URL:http://security.gentoo.org/glsa/glsa-200804-10.xml HP:HPSBST02955 URL:http://marc.info/?l=bugtraq&m=139344343412337&w=2 MANDRIVA:MDKSA-2007:241 URL:~~http://www.mandriva.com/security/advisories?name=MDKSA-2007:241~~ (Obsolete source) MANDRIVA:MDVSA-2009:136 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2009:136~~ (Obsolete source) MISC:http://issues.apache.org/jira/browse/GERONIMO-3549 MLIST:[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ URL:https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ URL:https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ URL:https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ URL:https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ URL:https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E MLIST:[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet URL:http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3E OVAL:oval:org.mitre.oval:def:9202 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202 REDHAT:RHSA-2008:0042 URL:http://www.redhat.com/support/errata/RHSA-2008-0042.html REDHAT:RHSA-2008:0195 URL:http://www.redhat.com/support/errata/RHSA-2008-0195.html REDHAT:RHSA-2008:0261 URL:http://www.redhat.com/support/errata/RHSA-2008-0261.html REDHAT:RHSA-2008:0630 URL:http://rhn.redhat.com/errata/RHSA-2008-0630.html REDHAT:RHSA-2008:0862 URL:http://www.redhat.com/support/errata/RHSA-2008-0862.html SECTRACK:1018864 URL:http://www.securitytracker.com/id?1018864 SECUNIA:27398 URL:http://secunia.com/advisories/27398 SECUNIA:27446 URL:http://secunia.com/advisories/27446 SECUNIA:27481 URL:http://secunia.com/advisories/27481 SECUNIA:27727 URL:http://secunia.com/advisories/27727 SECUNIA:28317 URL:http://secunia.com/advisories/28317 SECUNIA:28361 URL:http://secunia.com/advisories/28361 SECUNIA:29242 URL:http://secunia.com/advisories/29242 SECUNIA:29313 URL:http://secunia.com/advisories/29313 SECUNIA:29711 URL:http://secunia.com/advisories/29711 SECUNIA:30676 URL:http://secunia.com/advisories/30676 SECUNIA:30802 URL:http://secunia.com/advisories/30802 SECUNIA:30899 URL:http://secunia.com/advisories/30899 SECUNIA:30908 URL:http://secunia.com/advisories/30908 SECUNIA:31493 URL:http://secunia.com/advisories/31493 SECUNIA:32120 URL:http://secunia.com/advisories/32120 SECUNIA:32222 URL:http://secunia.com/advisories/32222 SECUNIA:32266 URL:http://secunia.com/advisories/32266 SECUNIA:37460 URL:http://secunia.com/advisories/37460 SECUNIA:57126 URL:http://secunia.com/advisories/57126 SUNALERT:239312 URL:~~http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1~~ (Obsolete source) SUSE:SUSE-SR:2008:005 URL:http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html SUSE:SUSE-SR:2009:004 URL:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html VUPEN:ADV-2007-3622 URL:~~http://www.vupen.com/english/advisories/2007/3622~~ (Obsolete source) VUPEN:ADV-2007-3671 URL:~~http://www.vupen.com/english/advisories/2007/3671~~ (Obsolete source) VUPEN:ADV-2007-3674 URL:~~http://www.vupen.com/english/advisories/2007/3674~~ (Obsolete source) VUPEN:ADV-2008-1856 URL:~~http://www.vupen.com/english/advisories/2008/1856/references~~ (Obsolete source) VUPEN:ADV-2008-1979 URL:~~http://www.vupen.com/english/advisories/2008/1979/references~~ (Obsolete source) VUPEN:ADV-2008-1981 URL:~~http://www.vupen.com/english/advisories/2008/1981/references~~ (Obsolete source) VUPEN:ADV-2008-2780 URL:~~http://www.vupen.com/english/advisories/2008/2780~~ (Obsolete source) VUPEN:ADV-2008-2823 URL:~~http://www.vupen.com/english/advisories/2008/2823~~ (Obsolete source) VUPEN:ADV-2009-3316 URL:~~http://www.vupen.com/english/advisories/2009/3316~~ (Obsolete source) XF:apache-tomcat-webdav-dir-traversal(37243) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/37243
Assigning CNA
Red Hat, Inc.
Date Record Created
20071015	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20071015)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)