Red Hat Security AdvisoryRHSA-2008:0877
jbossweb security update
Released 2008-09-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
Fixes 3 records
Priority HIGH 65
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encode…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.99708 · Published 2008-08-13 · Fixed in 4.1.39, 5.5.27 +1 CWE-22
Priority MEDIUM 59
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is u…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.75865 · Published 2008-08-04 · Fixed in 4.1.38, 5.5.27 +1 CWE-79
Priority MEDIUM 55
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attacke…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.52716 · Published 2008-08-04 · Fixed in 4.1.38, 5.5.27 +1 CWE-22
THREATIST.IORead the docs