CVE-2009-2902: Path Traversal Vulnerability in Apache Tomcat
Summary
CVE-2009-2902: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 5.5.0, < 5.5.29
>= 6.0.0, < 6.0.24
Fixed in 5.5.29 or 6.0.24, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. The vulnerability in Apache Tomcat allows remote attackers to delete files in the work directory by exploiting a directory traversal vulnerability. This vulnerability affects Apache Tomcat versions 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20.
Vulnerability Detail
The vulnerability arises from improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. Attackers can exploit this vulnerability by using directory traversal sequences in a WAR (Web Application Archive) filename. By manipulating the filename, an attacker can traverse directories and delete files within the work directory. This can lead to the deletion of critical files and disruption of the web application's functionality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.295.5.29 -
>= 6.0.0, < 6.0.246.0.24
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The directory traversal vulnerability in Apache Tomcat can be exploited by remote attackers to delete files in the work directory. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Tomcat. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
A directory traversal vulnerability, also known as a path traversal vulnerability, allows an attacker to access files and directories outside of the intended directory structure. By manipulating input parameters or filenames, an attacker can traverse directories and access sensitive files.
The vulnerability allows remote attackers to delete files in the work directory of Apache Tomcat. This can lead to the disruption of web application functionality and potential data loss.
The vulnerability affects Apache Tomcat versions 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, upgrading to the fixed versions of Apache Tomcat (5.5.29 or later for versions 5.5.0 through 5.5.28, and 6.0.24 or later for versions 6.0.0 through 6.0.20) will patch the vulnerability and prevent exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.