CVE-2007-0450
Apache Tomcat Directory Traversal
5.0 MediumPublic exploitFix available
CVE-2007-0450 is a medium vulnerability (CVSS 5.0) in Apache Http Server, published March 16, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.2%, the 99th percentile. Fixed in org.apache.tomcat:tomcat 5.5.22.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 91.2%EPSS, 99th percentile
- Exploitation
- None known1 public exploit
- Fixed in
5.5.22org.apache.tomcat:tomcat +153 more
Description
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
Exploit likelihood
91.2%Up 52.9 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven | 5.0 up to 5.5.22 | 5.5.22 |
org.apache.tomcat:tomcatMaven | 6.0 up to 6.0.10 | 6.0.10 |
jakarta-commons-modelerRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
jakarta-commons-modeler-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
Show 144 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs | before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
jakarta-commons-modelerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
jakarta-commons-modelerRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
jakarta-commons-modelerRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:2.0-3jpp_3rh | 0:2.0-3jpp_3rh |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs | before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5Red Hat:rhel_application_server:1 From an advisory covering 8 CVEs | before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-admin-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs | before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs | before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
jbossasRed Hat:rhel_application_stack:1 From an advisory covering 3 CVEs | before 0:4.0.5-2.CP04.el4s1.2 | 0:4.0.5-2.CP04.el4s1.2 |
jakarta-commons-poolRed Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs | before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs | before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs | before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs | before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs | before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs | before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
antRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs | before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 5.x/6.0.x - Directory Traversal | 2007-03-14 |
What each source reports
NVD Score used
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
- Record
CVE-2007-0450- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
- Record
CVE-2007-0450- Updated
- 2026-11-02
EUVDEUVD-2022-2420No score
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
- Record
EUVD-2022-2420- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4prh-gqw8-rgh5No score
Apache Tomcat Directory Traversal
Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) / (slash), (2) \ (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
- Record
GHSA-4prh-gqw8-rgh5- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-4prh-gqw8-rgh5No score
Apache Tomcat Directory Traversal
Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) / (slash), (2) \ (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
- Record
GHSA-4prh-gqw8-rgh5- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases | ||
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
tomcat.apache.org/security-4.html
secunia.com/advisories/30908
lists.vmware.com/pipermail/security-announce/2008/000003.html
vupen.com/english/advisories/2007/2732
sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
Show 194 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/32988
novell.com/linux/security/advisories/2007_5_sr.html
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
securityfocus.com/archive/1/500412/100/0/threaded
redhat.com/support/errata/RHSA-2007-0360.html
support.avaya.com/elmodocs2/security/ASA-2007-206.htm
sec-consult.com/287.html
docs.info.apple.com/article.html?artnum=306172
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
fujitsu.com/global/support/software/security/products-f/interstage-200702e.html
security.gentoo.org/glsa/glsa-200705-03.xml
securityreason.com/securityalert/2446
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
mandriva.com/security/advisories?name=MDKSA-2007:241
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10643
lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-0450
github.com/apache/tomcat/commit/0c5ec5b958f1b59840ee155a23ab409755b039f6
access.redhat.com/errata/RHSA-2007:0326
bugzilla.redhat.com/show_bug.cgi?id=237086
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0326.json
cve.org/CVERecord?id=CVE-2005-2090
This page doesn't list everything
Left out here: 149 references. The JSON record has them.