CVE-2009-2693
published 2010-01-28CVE-2009-2693: Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files…
PriorityP337medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EPSS
9.64%
95.0th percentile
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Tomcat Directory Traversal vulnerability
ghsa·2022-05-02
CVE-2009-2693 [MEDIUM] CWE-22 Apache Tomcat Directory Traversal vulnerability
Apache Tomcat Directory Traversal vulnerability
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a `..` (dot dot) in an entry in a WAR file, as demonstrated by a `../../bin/catalina.bat` entry.
OSV
Apache Tomcat Directory Traversal vulnerability
osv·2022-05-02
CVE-2009-2693 [MEDIUM] Apache Tomcat Directory Traversal vulnerability
Apache Tomcat Directory Traversal vulnerability
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a `..` (dot dot) in an entry in a WAR file, as demonstrated by a `../../bin/catalina.bat` entry.
VMware
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
vendor_vmware·2011-02-10·CVSS 5.0
CVE-2008-0085 [MEDIUM] Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
VMSA-2011-0003: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory VMware Security Advisory Advisory ID: VMware Security Advisory Synopsis: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory Issue date: VMware Security Advisory Updated on: VMware Security Advisory CVE numbers:
CVEs: CVE-2008-0085, CVE-2008-0086, CVE-2008-0106, CVE-2008-0107, CVE-2008-3825, CVE-2008-5416, CVE-2009-1384, CVE-2009-2693, CVE-2009-2901, CVE-2009-2902, CVE-2009-3548, CVE-2009-3555, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0008, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085,
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2010-02-11
CVE-2009-2693 Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Tomcat vulnerabilities
It was discovered that Tomcat did not correctly validate WAR filenames or
paths when deploying. A remote attacker could send a specially crafted WAR
file to be deployed and cause arbitrary files and directories to be
created, overwritten, or deleted.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
tomcat: unexpected file deletion and/or alteration
vendor_redhat·2010-01-24·CVSS 5.8
CVE-2009-2693 [MEDIUM] tomcat: unexpected file deletion and/or alteration
tomcat: unexpected file deletion and/or alteration
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-2901 CVE-2009-2902 CVE-2009-2693 CVE-2010-1157 tomcat: multiple vulnerabilities [fedora-all]
bugzilla·2010-04-23·CVSS 5.8
CVE-2009-2901 [MEDIUM] CVE-2009-2901 CVE-2009-2902 CVE-2009-2693 CVE-2010-1157 tomcat: multiple vulnerabilities [fedora-all]
CVE-2009-2901 CVE-2009-2902 CVE-2009-2693 CVE-2010-1157 tomcat: multiple vulnerabilities [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
Forr more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=585331
Please note:
Bugzilla
CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
bugzilla·2010-01-28·CVSS 5.8
CVE-2009-2693 [MEDIUM] CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
CVE-2009-2693 tomcat: unexpected file deletion and/or alteration
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2693 to
the following vulnerability:
Name: CVE-2009-2693
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2693
Assigned: 20090805
Reference: BUGTRAQ:20100124 [SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/509148/100/0/threaded
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=892815&view=rev
Reference: CONFIRM: http://svn.apache.org/viewvc?rev=902650&view=rev
Reference: CONFIRM: http://tomcat.apache.org/security-5.html
Reference: CONFIRM: http://tomcat.apache.org/security-6.html
Reference: BID:37944
Reference: URL: http://www.securityfocus.com/
Bugzilla
CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
bugzilla·2009-11-09·CVSS 5.0
CVE-2009-0033 [MEDIUM] CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2008-5515 CVE-2009-0781 Multiple tomcat5 vulnerabilities [Fedora all]
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
You should *not* refer to this bug publicly, as it is a private "Fedora Project Contributors" bug.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #493381: CVE-2009-0033 tomcat6 Denial-Of-Service with AJP connection
bug #503978: CVE-2009-0580 tomcat6 Information disclosure in authentication classes
bug #504153: CVE-2009-0783 tomcat XML parser information disclosure
bug #504753: CVE-2008-5515 tomcat request dispatcher information d
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00089.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00090.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00037.htmlhttp://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=133469267822771&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/38316http://secunia.com/advisories/38346http://secunia.com/advisories/38541http://secunia.com/advisories/38687http://secunia.com/advisories/39317http://secunia.com/advisories/40330http://secunia.com/advisories/40813http://secunia.com/advisories/43310http://secunia.com/advisories/57126http://securitytracker.com/id?1023505http://support.apple.com/kb/HT4077http://svn.apache.org/viewvc?rev=892815&view=revhttp://svn.apache.org/viewvc?rev=902650&view=revhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://ubuntu.com/usn/usn-899-1http://www.debian.org/security/2011/dsa-2207http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://www.mandriva.com/security/advisories?name=MDVSA-2010:177http://www.redhat.com/support/errata/RHSA-2010-0119.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0580.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0582.htmlhttp://www.securityfocus.com/archive/1/509148/100/0/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.securityfocus.com/bid/37944http://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlhttp://www.vupen.com/english/advisories/2010/0213http://www.vupen.com/english/advisories/2010/1559http://www.vupen.com/english/advisories/2010/1986https://exchange.xforce.ibmcloud.com/vulnerabilities/55855https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19355https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7017http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00089.htmlhttp://lists.opensuse.org/opensuse-updates/2012-12/msg00090.htmlhttp://lists.opensuse.org/opensuse-updates/2013-01/msg00037.htmlhttp://marc.info/?l=bugtraq&m=127420533226623&w=2http://marc.info/?l=bugtraq&m=133469267822771&w=2http://marc.info/?l=bugtraq&m=136485229118404&w=2http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/38316http://secunia.com/advisories/38346http://secunia.com/advisories/38541http://secunia.com/advisories/38687http://secunia.com/advisories/39317http://secunia.com/advisories/40330http://secunia.com/advisories/40813http://secunia.com/advisories/43310http://secunia.com/advisories/57126http://securitytracker.com/id?1023505http://support.apple.com/kb/HT4077http://svn.apache.org/viewvc?rev=892815&view=revhttp://svn.apache.org/viewvc?rev=902650&view=revhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://ubuntu.com/usn/usn-899-1http://www.debian.org/security/2011/dsa-2207http://www.mandriva.com/security/advisories?name=MDVSA-2010:176http://www.mandriva.com/security/advisories?name=MDVSA-2010:177http://www.redhat.com/support/errata/RHSA-2010-0119.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0580.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0582.htmlhttp://www.securityfocus.com/archive/1/509148/100/0/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.securityfocus.com/bid/37944http://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlhttp://www.vupen.com/english/advisories/2010/0213http://www.vupen.com/english/advisories/2010/1559http://www.vupen.com/english/advisories/2010/1986https://exchange.xforce.ibmcloud.com/vulnerabilities/55855https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19355https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7017
2010-01-28
Published