// For flags

CVE-2009-0783

tomcat XML parser information disclosure

Severity Score

4.2
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

Apache Tomcat v4.1.0 hasta la v4.1.39, v5.5.0 hasta la v5.5.27 y v6.0.0 hasta la v6.0.18 permite a las aplicaciones web reemplazar un "parser" (extractor de información) XML utilizado por otras aplicaciones web, lo que permite a los usuarios locales leer o modificar los ficheros (1) web.xml, (2) context.xml o (3) ficheros tld de aplicaciones web de su elección a través de una aplicacion manipulada que es cargada antes de la aplicación web objetivo del ataque.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Local
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-03-04 CVE Reserved
  • 2009-06-05 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (49)
URL Tag Source
http://support.apple.com/kb/HT4077 Third Party Advisory
http://www.securityfocus.com/archive/1/504090/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded Mailing List
http://www.securityfocus.com/bid/35416 Third Party Advisory
http://www.securitytracker.com/id?1022336 Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51195 Vdb Entry
https://issues.apache.org/bugzilla/show_bug.cgi?id=45933 Issue Tracking
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450 Signature
URL Date SRC
URL Date SRC
http://svn.apache.org/viewvc?rev=652592&view=rev 2023-02-13
http://svn.apache.org/viewvc?rev=681156&view=rev 2023-02-13
http://svn.apache.org/viewvc?rev=739522&view=rev 2023-02-13
http://svn.apache.org/viewvc?rev=781542&view=rev 2023-02-13
http://svn.apache.org/viewvc?rev=781708&view=rev 2023-02-13
http://tomcat.apache.org/security-4.html 2023-02-13
http://tomcat.apache.org/security-5.html 2023-02-13
http://tomcat.apache.org/security-6.html 2023-02-13
https://issues.apache.org/bugzilla/show_bug.cgi?id=29936 2023-02-13
URL Date SRC
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html 2023-02-13
http://marc.info/?l=bugtraq&m=127420533226623&w=2 2023-02-13
http://marc.info/?l=bugtraq&m=129070310906557&w=2 2023-02-13
http://marc.info/?l=bugtraq&m=136485229118404&w=2 2023-02-13
http://secunia.com/advisories/35685 2023-02-13
http://secunia.com/advisories/35788 2023-02-13
http://secunia.com/advisories/37460 2023-02-13
http://secunia.com/advisories/42368 2023-02-13
http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 2023-02-13
http://www.debian.org/security/2011/dsa-2207 2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2009:136 2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2009:138 2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:176 2023-02-13
http://www.vupen.com/english/advisories/2009/1856 2023-02-13
http://www.vupen.com/english/advisories/2009/3316 2023-02-13
http://www.vupen.com/english/advisories/2010/3056 2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html 2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html 2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html 2023-02-13
https://access.redhat.com/security/cve/CVE-2009-0783 2009-11-30
https://bugzilla.redhat.com/show_bug.cgi?id=504153 2009-11-30
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 >= 4.1.0 <= 4.1.39
Search vendor "Apache" for product "Tomcat" and version " >= 4.1.0 <= 4.1.39"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 >= 5.5.0 <= 5.5.27
Search vendor "Apache" for product "Tomcat" and version " >= 5.5.0 <= 5.5.27"
-
Affected
Apache
Search vendor "Apache"
 Tomcat
Search vendor "Apache" for product "Tomcat"
 >= 6.0.0 <= 6.0.18
Search vendor "Apache" for product "Tomcat" and version " >= 6.0.0 <= 6.0.18"
-
Affected