Skip to content

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Low severity GitHub Reviewed Published May 14, 2022 to the GitHub Advisory Database • Updated Feb 21, 2024

Package

maven org.apache.tomcat:tomcat (Maven)

Affected versions

>= 7.0.0, < 7.0.4
>= 6.0.0, < 6.0.30
>= 5.5.0, < 5.5.30

Patched versions

7.0.4
6.0.30
5.5.30

Description

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

References

Published by the National Vulnerability Database Feb 10, 2011
Published to the GitHub Advisory Database May 14, 2022
Reviewed Jul 8, 2022
Last updated Feb 21, 2024

Severity

Low

EPSS score

0.163%
(53rd percentile)

Weaknesses

CVE ID

CVE-2010-3718

GHSA ID

GHSA-fj6c-prgj-gr3r

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.