CVE-2007-5461: apache tomcat

Modified

AliasesGHSA-v5p2-vg3c-pmrr

Published 15-10-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5461 is a low (CVSS 3.5) vulnerability in apache tomcat. EPSS estimates a 39.68% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 21-10-2007)

Source freshness unavailable

How is this decided?

CVSS score

3.5/10

010

Low · v2.0 (NVD)

EPSS score

39.68%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 12

DSA-1447-1 DSA-1453-1 RHSA-2008:0042 RHSA-2008:0151 RHSA-2008:0158 RHSA-2008:0195+6 more

Timeline

15-10-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CVSS metrics

1 score · 1 source · 1 version

v2.03.5

EPSS trend

Probability

39.68%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 39.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (marc.info)
Maturity: unknown
exploit-databaseremotelinuxVerified
Apache Tomcat - WebDAV SSL Remote File Disclosure
Maturity: weaponized
exploit-databaseremotemultipleVerified
Apache Tomcat - 'WebDAV' Remote File Disclosure
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

tomcat4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.1.0 | 4.1.1 | 4.1.2 | 4.1.3 | 4.1.4 | 4.1.5 | 4.1.6 | 4.1.7 | 4.1.8 | 4.1.9 | 4.1.10 | 4.1.11 | 4.1.12 | 4.1.13 | 4.1.14 | 4.1.15 | 4.1.16 | 4.1.17 | 4.1.18 | 4.1.19 | 4.1.20 | 4.1.21 | 4.1.22 | 4.1.23 | 4.1.24 | 4.1.25 | 4.1.26 | 4.1.27 | 4.1.28 | 4.1.29 | 4.1.30 | 4.1.31 | 4.1.32 | 4.1.33 | 4.1.34 | 4.1.35 | 4.1.36

Org.apache.tomcat1 product

tomcat≥ 4.0.0, ≤ 4.0.6 | 4.1.0 | 5.0.0 | ≥ 5.5.0, ≤ 5.5.25 | ≥ 6.0.0, ≤ 6.0.14

2 vendors · 2 products

References

84 links

www.debian.org/security/2008/dsa-1453Vendor AdvisoryX Refsource DEBIANWEB
tomcat.apache.org/security-4.htmlX Refsource CONFIRMWEB
secunia.com/advisories/30908Third Party AdvisoryX Refsource SECUNIA
support.apple.com/kb/HT2163X Refsource CONFIRMWEB
mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3EMailing ListX Refsource MLIST
www.securityfocus.com/bid/26070VDB EntryX Refsource BID
secunia.com/advisories/27446Third Party AdvisoryX Refsource SECUNIA
marc.info?l=full-disclosure&m=119239530508382Mailing ListX Refsource FULLDISCExploitWEB
secunia.com/advisories/30676Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2008-0630.htmlVendor AdvisoryX Refsource REDHATWEB

Show all 84 references

sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1Vendor AdvisoryX Refsource SUNALERT
exchange.xforce.ibmcloud.com/vulnerabilities/37243VDB EntryX Refsource XFWEB
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202VDB EntrySignatureX Refsource OVAL
www.redhat.com/support/errata/RHSA-2008-0862.htmlVendor AdvisoryX Refsource REDHATWEB
www.vupen.com/english/advisories/2008/1981/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/30899Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.htmlVendor AdvisoryX Refsource FEDORAWEB
secunia.com/advisories/31493Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29242Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2823VDB EntryX Refsource VUPEN
secunia.com/advisories/37460Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1979/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/29313Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/31681VDB EntryX Refsource BID
secunia.com/advisories/32120Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/3671VDB EntryX Refsource VUPEN
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRM
secunia.com/advisories/27398Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0042.htmlVendor AdvisoryX Refsource REDHATWEB
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.htmlVendor AdvisoryX Refsource SUSEWEB
www.securitytracker.com/id?1018864VDB EntryX Refsource SECTRACK
secunia.com/advisories/28361Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28317Third Party AdvisoryX Refsource SECUNIA
lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlVendor AdvisoryX Refsource APPLEWEB
support.avaya.com/elmodocs2/security/ASA-2008-401.htmX Refsource CONFIRM
www.vupen.com/english/advisories/2007/3674VDB EntryX Refsource VUPEN
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQ
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlVendor AdvisoryX Refsource SUSEWEB
tomcat.apache.org/security-6.htmlX Refsource CONFIRMWEB
secunia.com/advisories/57126Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32222Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30802Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0195.htmlVendor AdvisoryX Refsource REDHATWEB
security.gentoo.org/glsa/glsa-200804-10.xmlVendor AdvisoryX Refsource GENTOOWEB
geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.htmlX Refsource CONFIRMWEB
www.vupen.com/english/advisories/2007/3622VDB EntryX Refsource VUPEN
www-1.ibm.com/support/docview.wss?uid=swg21286112X Refsource CONFIRM
secunia.com/advisories/27727Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1856/referencesVDB EntryX Refsource VUPEN
www.vmware.com/security/advisories/VMSA-2008-0010.htmlX Refsource CONFIRM
tomcat.apache.org/security-5.htmlX Refsource CONFIRMWEB
www.vupen.com/english/advisories/2008/2780VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0261.htmlVendor AdvisoryX Refsource REDHATWEB
www.exploit-db.com/exploits/4530ExploitX Refsource EXPLOIT DB
www.mandriva.com/security/advisories?name=MDVSA-2009:136Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2008/dsa-1447Vendor AdvisoryX Refsource DEBIANWEB
secunia.com/advisories/27481Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=139344343412337&w=2Vendor AdvisoryX Refsource HPWEB
lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlVendor AdvisoryX Refsource APPLEWEB
support.apple.com/kb/HT3216X Refsource CONFIRMWEB
www.mandriva.com/security/advisories?name=MDKSA-2007:241Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/29711Third Party AdvisoryX Refsource SECUNIA
issues.apache.org/jira/browse/GERONIMO-3549X Refsource MISCWEB
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPEN
secunia.com/advisories/32266Third Party AdvisoryX Refsource SECUNIA
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
nvd.nist.gov/vuln/detail/CVE-2007-5461Advisory
github.com/apache/tomcat/commit/1e7b31e24801777f4de45d565f6a20a5377dd22cWEB
github.com/apache/tomcat/commit/901292cf9d7d8225f8a3b96c7583e2bd8b41772dWEB
github.com/apache/tomcatWEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3EWEB