CVE-2008-2370
Apache Tomcat Path Traversal Vulnerability
5.0 MediumPublic exploitFix available
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Exploit likelihood
52.7%Down 20.7 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
- Record
CVE-2008-2370- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
- Record
CVE-2008-2370- Updated
- 2026-11-02
EUVDEUVD-2022-4524 No score
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
- Record
EUVD-2022-4524- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m8h8-6rvg-f4mg No score
Apache Tomcat Path Traversal Vulnerability
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
- Record
GHSA-m8h8-6rvg-f4mg- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-m8h8-6rvg-f4mg No score
Apache Tomcat Path Traversal Vulnerability
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
- Record
GHSA-m8h8-6rvg-f4mg- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
4.1.0 to 4.1.37 | 4.1.38 |
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.26 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.16 | 6.0.18 |
org.apache.tomcat:tomcatMaven |
4.1.0 up to 4.1.38 | 4.1.38 |
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.27 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.18 | 6.0.18 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
Show 84 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el4 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el4 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el5 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 3 CVEs |
before 0:2.0.0-5.CP07.0jpp.ep1.1.el5 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
tomcat5Red Hat:network_satellite:5.1::el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
antRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure | 2008-08-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2370 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published August 4, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 52.7%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 4.1.38.
References
securityfocus.com/bid/30494
tomcat.apache.org/security-4.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10577
vupen.com/english/advisories/2009/1535
redhat.com/support/errata/RHSA-2008-0862.html
Show 194 moreShow less
secunia.com/advisories/34013
vmware.com/security/advisories/VMSA-2009-0002.html
securityreason.com/securityalert/4099
lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
mandriva.com/security/advisories?name=MDVSA-2008:188
support.avaya.com/elmodocs2/security/ASA-2008-401.htm
exchange.xforce.ibmcloud.com/vulnerabilities/44156
securitytracker.com/id?1020623
fujitsu.com/global/support/software/security/products-f/interstage-200902e.html
marc.info?l=bugtraq&m=123376588623823&w=2
lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
support.apple.com/kb/HT3216
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2008-2370
web.archive.org/web/20080827150120/http://securityreason.com/securityalert/4099
github.com/advisories/GHSA-m8h8-6rvg-f4mg
access.redhat.com/errata/RHSA-2008:0648
bugzilla.redhat.com/show_bug.cgi?id=446393
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0648.json
cve.org/CVERecord?id=CVE-2008-1232
This page doesn't list everything
Left out here: 77 references. The JSON record has them.