CVE-2008-2370
Publication date 4 August 2008
Last updated 24 July 2024
Ubuntu priority
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| tomcat5.5 | ||
| tomcat6 | ||