CVE-2009-0783
published 2009-06-05CVE-2009-0783: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web…
PriorityP419medium4.2CVSS 3.0
AVLACLPRHUINSUCLILAL
EPSS
0.81%
53.1th percentile
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 4.1.0 – 4.1.39 | — |
| apache | tomcat | 5.5.0 – 5.5.27 | — |
| apache | tomcat | 6.0.0 – 6.0.18 | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
CVSS provenance
nvdv3.04.2MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
ghsa4.2MEDIUM
osv4.2MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache Tomcat CVE-2009-0783 regression
vendor_redhat·2011-08-12·CVSS 4.2
CVE-2011-2481 [MEDIUM] Apache Tomcat CVE-2009-0783 regression
Apache Tomcat CVE-2009-0783 regression
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Statement: This issue did not affect any version of Tomcat shipped in Red Hat products. This flaw only affected Tomcat versions 7.0.0 - 7.0.16.
Package: tomcat5 (Red Hat Enterprise Linux 5) - Not affected
Package: tomcat6 (Red Hat Enterprise Linux 6) - Not affected
VMware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
vendor_vmware·2009-11-20·CVSS 5.0
CVE-2007-2052 [MEDIUM] VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
VMSA-2009-0016: VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
a. JRE Security Update JRE update to version 1.5.0_20, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2009-06-15·CVSS 5.0
CVE-2009-0580 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Tomcat vulnerabilities
Iida Minehiko discovered that Tomcat did not properly normalise paths. A
remote attacker could send specially crafted requests to the server and
bypass security restrictions, gaining access to sensitive content.
(CVE-2008-5515)
Yoshihito Fukuyama discovered that Tomcat did not properly handle errors
when the Java AJP connector and mod_jk load balancing are used. A remote
attacker could send specially crafted requests containing invalid headers
to the server and cause a temporary denial of service. (CVE-2009-0033)
D. Matscheko and T. Hackner discovered that Tomcat did not properly handle
malformed URL encoding of passwords when FORM authentication is used. A
remote attacker could exploit this in order to enumerate valid usern
Red Hat
tomcat XML parser information disclosure
vendor_redhat·2009-06-04·CVSS 4.2
CVE-2009-0783 [MEDIUM] tomcat XML parser information disclosure
tomcat XML parser information disclosure
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
OSV
Apache Tomcat Allows Replacing of XML Parser
osv·2022-05-17·CVSS 4.2
CVE-2011-2481 [MEDIUM] Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
GHSA
Apache Tomcat Allows Replacing of XML Parser
ghsa·2022-05-17·CVSS 4.2
CVE-2011-2481 [MEDIUM] CWE-200 Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
ghsa·2022-05-02
CVE-2009-0783 [MEDIUM] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
osv·2022-05-02
CVE-2009-0783 [MEDIUM] Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-2481 Apache Tomcat CVE-2009-0783 regression
bugzilla·2011-08-23·CVSS 4.2
CVE-2011-2481 [MEDIUM] CVE-2011-2481 Apache Tomcat CVE-2009-0783 regression
CVE-2011-2481 Apache Tomcat CVE-2009-0783 regression
From the upstream advisory:
https://tomcat.apache.org/security-7.html
Low: Information disclosure CVE-2011-2481
The re-factoring of XML validation for Tomcat 7.0.x re-introduced the
vulnerability previously reported as CVE-2009-0783. This was initially
reported as a memory leak. If a web application is the first web
application loaded, this bugs allows that web application to potentially
view and/or alter the web.xml, context.xml and tld files of other web
applications deployed on the Tomcat instance.
This was fixed in revision 1137753 and revision 1138788 and .
This was identified by the Tomcat security team on 20 June 2011 and made
public on 12 August 2011.
Affects: 7.0.0-7.0.16
Discussion:
Statement:
This issue did not affect
Bugzilla
CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
bugzilla·2009-11-09·CVSS 5.0
CVE-2009-0033 [MEDIUM] CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
You should *not* refer to this bug publicly, as it is a private "Fedora Project Contributors" bug.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #493381: CVE-2009-0033 tomcat6 Denial-Of-Service with AJP connection
bug #503978: CVE-2009-0580 tomcat6 Information disclosure in authentication classes
bug #504153: CVE-2009-0783 tomcat XML parser information disclosure
bug #504753: CVE-2008-5515 tomcat request dispatcher information d
Bugzilla
CVE-2009-0783 tomcat XML parser information disclosure
bugzilla·2009-06-04·CVSS 4.2
CVE-2009-0783 [MEDIUM] CVE-2009-0783 tomcat XML parser information disclosure
CVE-2009-0783 tomcat XML parser information disclosure
A web application was able to replace the XML parser used by Tomcat to process web.xml, context.xml and tld files. In limited circumstances these bugs may allow a rouge web application to view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance.
Fixes for tomcat5:
http://svn.apache.org/viewvc?rev=681156&view=rev
http://svn.apache.org/viewvc?rev=781542&view=rev
Fixes for tomcat6:
http://svn.apache.org/viewvc?rev=652592&view=rev
http://svn.apache.org/viewvc?rev=739522&view=rev
Discussion:
This issue has been addressed in following products:
JBEAP 4.3.0 for RHEL 5
Via RHSA-2009:1145 https://rhn.redhat.com/errata/RHSA-2009-1145.html
---
This issue has been addressed in foll
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=129070310906557&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://secunia.com/advisories/35685http://secunia.com/advisories/35788http://secunia.com/advisories/37460http://secunia.com/advisories/42368http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1http://support.apple.com/kb/HT4077http://svn.apache.org/viewvc?rev=652592&view=revhttp://svn.apache.org/viewvc?rev=681156&view=revhttp://svn.apache.org/viewvc?rev=739522&view=revhttp://svn.apache.org/viewvc?rev=781542&view=revhttp://svn.apache.org/viewvc?rev=781708&view=revhttp://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://www.debian.org/security/2011/dsa-2207http://www.mandriva.com/security/advisories?name=MDVSA-2009:136http://www.mandriva.com/security/advisories?name=MDVSA-2009:138http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://www.securityfocus.com/archive/1/504090/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/bid/35416http://www.securitytracker.com/id?1022336http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/1856http://www.vupen.com/english/advisories/2009/3316http://www.vupen.com/english/advisories/2010/3056https://exchange.xforce.ibmcloud.com/vulnerabilities/51195https://issues.apache.org/bugzilla/show_bug.cgi?id=29936https://issues.apache.org/bugzilla/show_bug.cgi?id=45933https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.htmlhttp://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlhttp://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=129070310906557&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://secunia.com/advisories/35685http://secunia.com/advisories/35788http://secunia.com/advisories/37460http://secunia.com/advisories/42368http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1http://support.apple.com/kb/HT4077http://svn.apache.org/viewvc?rev=652592&view=revhttp://svn.apache.org/viewvc?rev=681156&view=revhttp://svn.apache.org/viewvc?rev=739522&view=revhttp://svn.apache.org/viewvc?rev=781542&view=revhttp://svn.apache.org/viewvc?rev=781708&view=revhttp://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://www.debian.org/security/2011/dsa-2207http://www.mandriva.com/security/advisories?name=MDVSA-2009:136http://www.mandriva.com/security/advisories?name=MDVSA-2009:138http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://www.securityfocus.com/archive/1/504090/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/bid/35416http://www.securitytracker.com/id?1022336http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/1856http://www.vupen.com/english/advisories/2009/3316http://www.vupen.com/english/advisories/2010/3056https://exchange.xforce.ibmcloud.com/vulnerabilities/51195https://issues.apache.org/bugzilla/show_bug.cgi?id=29936https://issues.apache.org/bugzilla/show_bug.cgi?id=45933https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html
2009-06-05
Published