CVE-2007-0450

Apache Tomcat 5.x/6.0.x - Directory Traversal

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Vulnerabilidad de salto de directorio en Apache HTTP Server y Tomcat 5.x anterior a 5.5.22 y 6.x anterior a 6.0.10, al usar ciertos módulos de proxy (mod_proxy, mod_rewrite, mod_jk), permite a atacantes remotos leer ficheros de su elección mediante una secuencia .. (punto punto) con combinaciones de caracteres (1) "/" (barra), (2) "\" (barra invertida), y (3) barra invertida con codificación de URL (%5C), los cuales son separadores válidos en Tomcat pero no en Apache.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-01-23 CVE Reserved
2007-03-14 First Exploit
2007-03-16 CVE Published
2024-08-07 CVE Updated
2025-03-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (59)

URL	Tag	Source
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	Broken Link
http://docs.info.apple.com/article.html?artnum=306172	Third Party Advisory
http://lists.vmware.com/pipermail/security-announce/2008/000003.html	Mailing List
http://secunia.com/advisories/24732	Third Party Advisory
http://secunia.com/advisories/25106	Third Party Advisory
http://secunia.com/advisories/25280	Third Party Advisory
http://secunia.com/advisories/26235	Third Party Advisory
http://secunia.com/advisories/26660	Third Party Advisory
http://secunia.com/advisories/27037	Third Party Advisory
http://secunia.com/advisories/28365	Third Party Advisory
http://secunia.com/advisories/30899	Third Party Advisory
http://secunia.com/advisories/30908	Third Party Advisory
http://secunia.com/advisories/33668	Third Party Advisory
http://securityreason.com/securityalert/2446	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm	Third Party Advisory
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	Broken Link
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.html	Third Party Advisory
http://www.sec-consult.com/287.html	Broken Link
http://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt	Broken Link
http://www.securityfocus.com/archive/1/462791/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/485938/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/500396/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/500412/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/22960	Third Party Advisory
http://www.securityfocus.com/bid/25159	Third Party Advisory
http://www.vupen.com/english/advisories/2007/0975	Third Party Advisory
http://www.vupen.com/english/advisories/2007/2732	Third Party Advisory
http://www.vupen.com/english/advisories/2007/3087	Third Party Advisory
http://www.vupen.com/english/advisories/2007/3386	Third Party Advisory
http://www.vupen.com/english/advisories/2008/0065	Third Party Advisory
http://www.vupen.com/english/advisories/2008/1979/references	Third Party Advisory
http://www.vupen.com/english/advisories/2009/0233	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32988	Third Party Advisory
https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10643	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/29739	2007-03-14

URL	Date	SRC

URL	Date	SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	2023-02-13
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	2023-02-13
http://security.gentoo.org/glsa/glsa-200705-03.xml	2023-02-13
http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1	2023-02-13
http://tomcat.apache.org/security-4.html	2023-02-13
http://tomcat.apache.org/security-5.html	2023-02-13
http://tomcat.apache.org/security-6.html	2023-02-13
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241	2023-02-13
http://www.novell.com/linux/security/advisories/2007_15_sr.html	2023-02-13
http://www.novell.com/linux/security/advisories/2007_5_sr.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2007-0327.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2007-0360.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2008-0261.html	2023-02-13
https://access.redhat.com/security/cve/CVE-2007-0450	2010-08-04
https://bugzilla.redhat.com/show_bug.cgi?id=237080	2010-08-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Http Server Search vendor "Apache" for product "Http Server"				-		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 5.0.0 < 5.5.22 Search vendor "Apache" for product "Tomcat" and version " >= 5.0.0 < 5.5.22"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 6.0.0 < 6.0.10 Search vendor "Apache" for product "Tomcat" and version " >= 6.0.0 < 6.0.10"		-		Affected