CVE-2008-0002: apache tomcat

Modified

AliasesGHSA-5x5f-9r6q-q7mh

Published 12-02-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0002 is a medium (CVSS 5.8) vulnerability in apache tomcat. EPSS estimates a 5.02% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.8/10

010

Medium · v2.0 (NVD)

EPSS score

5.02%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2008:0151 RHSA-2008:0158 RHSA-2008:0213

Timeline

12-02-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.

CVSS metrics

1 score · 1 source · 1 version

v2.05.8

EPSS trend

Probability

5.02%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.02% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

tomcatEOL6.0.5 | 6.0.6 | 6.0.7 | 6.0.8 | 6.0.9 | 6.0.10 | 6.0.11 | 6.0.12 | 6.0.13 | 6.0.14 | 6.0.15

Org.apache.tomcat1 product

tomcat≥ 6.0.0, < 6.0.16

2 vendors · 2 products

References

36 links

securityreason.com/securityalert/3638Third Party AdvisoryX Refsource SREASON
www.securityfocus.com/bid/27703VDB EntryX Refsource BID
secunia.com/advisories/28915Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/37460Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/487812/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/31681VDB EntryX Refsource BID
secunia.com/advisories/28834Third Party AdvisoryX Refsource SECUNIA
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRMWEB
www.vupen.com/english/advisories/2008/0488VDB EntryX Refsource VUPEN
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQ

Show all 36 references

lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.htmlVendor AdvisoryX Refsource SUSEWEB
tomcat.apache.org/security-6.htmlX Refsource CONFIRMWEB
secunia.com/advisories/57126Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32222Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.htmlVendor AdvisoryX Refsource FEDORAWEB
security.gentoo.org/glsa/glsa-200804-10.xmlVendor AdvisoryX Refsource GENTOOWEB
www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.htmlVendor AdvisoryX Refsource FEDORAWEB
www.vupen.com/english/advisories/2008/2780VDB EntryX Refsource VUPEN
marc.info?l=bugtraq&m=139344343412337&w=2Vendor AdvisoryX Refsource HPWEB
lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlVendor AdvisoryX Refsource APPLEWEB
support.apple.com/kb/HT3216X Refsource CONFIRMWEB
secunia.com/advisories/29711Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPEN
nvd.nist.gov/vuln/detail/CVE-2008-0002Advisory
github.com/apache/tomcatPACKAGE
web.archive.org/web/20080214133036/http://secunia.com/advisories/28915WEB
web.archive.org/web/20080715062302/http://secunia.com/advisories/29711WEB
web.archive.org/web/20080724052339/http://secunia.com/advisories/28834WEB
web.archive.org/web/20081012021650/http://www.securityfocus.com/bid/27703WEB
web.archive.org/web/20081013050642/http://secunia.com/advisories/32222WEB
web.archive.org/web/20081120062646/http://securityreason.com/securityalert/3638WEB
web.archive.org/web/20081121133027/http://www.securityfocus.com/archive/1/487812/100/0/threadedWEB
web.archive.org/web/20091125140215/http://secunia.com/advisories/37460WEB
web.archive.org/web/20120825080137/http://www.securityfocus.com/bid/31681WEB
web.archive.org/web/20140723000733/http://secunia.com/advisories/57126WEB
web.archive.org/web/20150621204350/http://www.securityfocus.com/archive/1/507985/100/0/threadedWEB