{"id":"CVE-2009-2902","aliases":["DSA-2207-1","EUVD-2022-3250","GHSA-8wch-9gcg-v2pr","RHSA-2010:0119","RHSA-2010:0580","RHSA-2010:0582","RHSA-2010:0693"],"status":"published","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10741,"percentile":0.95855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2010-01-28T20:00:00Z","modified":"2026-08-05T10:01:27Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["5.5.29","6.0.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"last_affected":"5.5.28"},{"fixed":"5.5.29"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.0.20"},{"fixed":"6.0.24"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"tomcat5.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.26-5lenny2"}]}],"versions":["5.5.26-5"],"bundled":9},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.29"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.24"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-apr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-apr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"httpd22-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-commons-chain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-2.1.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-commons-digester","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4-1.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-commons-modeler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-3.3.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-commons-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-7.4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jakarta-oro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.8-3jpp.ep1.3.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jboss-javaee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.1-2.3.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jboss-javaee-poms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.1-2.3.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"jboss-transaction-1.0.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.0.1-2.3.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"mod_jk-ap20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"mod_ssl22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.14-4.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"struts12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-2.0.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-2.0.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-jasper-eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"xerces-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-2.2_patch_01.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el4","package":"xml-commons-resolver12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2-1.1.ep5.el4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"glassfish-jsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2_13-3.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-1.2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-1.2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-1.2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"jakarta-commons-chain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2-2.1.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"jakarta-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4-1.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"jakarta-oro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.8-3.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"mod_jk-ap20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.28-4.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.14-1.2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"struts12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-2.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.19-2.0.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-jasper-eclipse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.28-7.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:1::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-2.1.ep5.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"tomcat5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp.9.el5_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-jasper-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-jsp-2.0-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-servlet-2.4-api-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_application_server:2","package":"tomcat5-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.17"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-common-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-jsp-2.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-server-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:certificate_system:7.3","package":"tomcat5-servlet-2.4-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.5.23-0jpp_4rh.19"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://securitytracker.com/id?1023504","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?rev=892815\u0026view=rev","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/39317","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19431","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/509150/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.debian.org/security/2011/dsa-2207","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://secunia.com/advisories/40330","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:177","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","web"]},{"url":"http://secunia.com/advisories/43310","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2010/1559","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/1986","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0580.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/40813","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/38541","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:176","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/57126","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://ubuntu.com/usn/usn-899-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://support.apple.com/kb/HT4077","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/38687","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/38346","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM","x_transferred","web","article"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0003.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/37945","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7092","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0119.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0582.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://secunia.com/advisories/38316","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/516397/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2010/0213","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?rev=902650\u0026view=rev","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/55857","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2902","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6","tags":["web"]},{"url":"https://github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0119","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0580","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0582","tags":["web","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:19431","tags":["web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7092","tags":["web"]},{"url":"https://support.apple.com/kb/HT4077","tags":["web"]},{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=c02241113","tags":["web"]},{"url":"https://web.archive.org/web/20100127015355/http://secunia.com/advisories/38346","tags":["web"]},{"url":"https://web.archive.org/web/20100127190258/http://secunia.com/advisories/38316","tags":["web"]},{"url":"https://web.archive.org/web/20100329100145/http://secunia.com/advisories/38687","tags":["web"]},{"url":"https://web.archive.org/web/20100412065745/http://secunia.com/advisories/39317","tags":["web"]},{"url":"https://web.archive.org/web/20100601000000*/http://secunia.com/advisories/40813","tags":["web"]},{"url":"https://web.archive.org/web/20110213053623/https://secunia.com/advisories/43310","tags":["web"]},{"url":"https://web.archive.org/web/20110529135656/http://secunia.com/advisories/38541","tags":["web"]},{"url":"https://web.archive.org/web/20110601000000*/http://secunia.com/advisories/40330","tags":["web"]},{"url":"https://web.archive.org/web/20111119150528/http://www.securityfocus.com/archive/1/516397/100/0/threaded","tags":["web"]},{"url":"https://web.archive.org/web/20121211115829/http://securitytracker.com/id?1023504","tags":["web"]},{"url":"https://web.archive.org/web/20121211195847/http://www.securityfocus.com/bid/37945","tags":["web"]},{"url":"https://web.archive.org/web/20140515000000*/http://secunia.com/advisories/57126","tags":["web"]},{"url":"https://web.archive.org/web/20150308000602/http://www.securityfocus.com/archive/1/509150/100/0/threaded","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8wch-9gcg-v2pr"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"http://kbase.redhat.com/faq/docs/DOC-20491","tags":["article"]},{"url":"http://www.redhat.com/docs/en-US/JBoss_Enterprise_Web_Server/1.0.1/html-single/Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=558872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=558873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=559738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=559761","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0119.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2902","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-3555","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-3555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-3555","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=598164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2086","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=612799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=616717","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0580.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2696","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2227","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0582.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0693","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0693.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-2902","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","status":"published","published":"2010-01-28T20:00:00Z","modified":"2024-08-07T06:07:37.16Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2022-3250","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","status":"published","published":"2010-01-28T20:00:00Z","modified":"2024-08-07T06:07:37Z","updated_at":"2026-11-03T01:39:15.098818Z"}],"ghsa":[{"id":"GHSA-8wch-9gcg-v2pr","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","status":"published","published":"2022-05-02T03:39:48Z","modified":"2024-02-21T17:35:46Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2009-2902","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","status":"published","published":"2010-01-28T20:30:01.323Z","modified":"2026-06-16T23:10:27.91Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"DSA-2207-1","title":"tomcat5.5 - several","status":"published","published":"2011-03-30T00:00:00Z","modified":"2026-03-09T01:20:54.721808Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"GHSA-8wch-9gcg-v2pr","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat","description":"Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.","status":"published","published":"2022-05-02T03:39:48Z","modified":"2024-02-21T17:35:45Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RHSA-2010:0119","title":"Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.1 update","status":"published","published":"2024-09-15T18:18:09Z","modified":"2026-06-29T10:03:02Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2010:0580","title":"Red Hat Security Advisory: tomcat5 security update","status":"published","published":"2024-09-29T16:27:51Z","modified":"2026-08-05T10:01:24Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2010:0582","title":"Red Hat Security Advisory: tomcat5 security update","status":"published","published":"2024-09-29T16:28:01Z","modified":"2026-08-05T10:01:25Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2010:0693","title":"Red Hat Security Advisory: tomcat5 security update","status":"published","published":"2024-09-29T16:28:15Z","modified":"2026-08-05T10:01:27Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}