CVE-2009-0783

MEDIUM

Apache Tomcat <6.0.19 - Info Disclosure

Title source: llm

Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

References (47)

[Mailing List] http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

[Third Party Advisory] http://marc.info/?l=bugtraq&m=127420533226623&w=2

[Third Party Advisory] http://marc.info/?l=bugtraq&m=129070310906557&w=2

[Third Party Advisory] http://marc.info/?l=bugtraq&m=136485229118404&w=2

[Vendor Advisory] http://secunia.com/advisories/35685

[Vendor Advisory] http://secunia.com/advisories/35788

[Vendor Advisory] http://secunia.com/advisories/37460

[Vendor Advisory] http://secunia.com/advisories/42368

[Third Party Advisory] http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1

[Third Party Advisory] http://support.apple.com/kb/HT4077

[Patch] http://svn.apache.org/viewvc?rev=652592&view=rev

[Patch] http://svn.apache.org/viewvc?rev=681156&view=rev

[Patch] http://svn.apache.org/viewvc?rev=739522&view=rev

[Patch] http://svn.apache.org/viewvc?rev=781542&view=rev

[Patch] http://svn.apache.org/viewvc?rev=781708&view=rev

[Patch, Vendor Advisory] http://tomcat.apache.org/security-4.html

[Patch, Vendor Advisory] http://tomcat.apache.org/security-5.html

[Patch, Vendor Advisory] http://tomcat.apache.org/security-6.html

[Third Party Advisory] http://www.debian.org/security/2011/dsa-2207

... and 27 more

Scores

CVSS v3 4.2

EPSS 0.0010

EPSS Percentile 27.1%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-200

Status draft

Affected Products (2)

apache/tomcat < 4.1.39

org.apache.tomcat/tomcat Maven

Timeline

Published Jun 05, 2009

Tracked Since Feb 18, 2026