Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and…
Priority HIGH 66CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
Why it matters now
EPSS 0.91158 99th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.22, 6.0.10Red Hat: 9 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.0 to before 5.5.22 | 5.5.22 | Patch available | GHSA-4prh-gqw8-rgh5 |
| — | org.apache.tomcat:tomcat (Maven) | 6.0 to before 6.0.10 | 6.0.10 | Patch available | GHSA-4prh-gqw8-rgh5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.0 to before 5.5.22 Fixed in 5.5.22 Patch available GHSA-4prh-gqw8-rgh5
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0 to before 6.0.10 Fixed in 6.0.10 Patch available GHSA-4prh-gqw8-rgh5
Remediation
- Fix · GHSA-4prh-gqw8-rgh5 org.apache.tomcat:tomcat (Maven) Fixed in 5.5.22 Advisory →
- Fix · GHSA-4prh-gqw8-rgh5 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.10 Advisory →
Red Hat 9 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2008:0524 Released 2008-06-30 · Red Hat rating LowRed Hat Network Satellite Server security update
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
- RHSA-2008:0261 Released 2008-05-20 · Red Hat rating ModerateRed Hat Network Satellite Server security update
- Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
Show 6 more Red Hat advisories
- RHSA-2007:1069 Released 2007-11-26 · Red Hat rating Moderatetomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- RHSA-2007:0360 Released 2007-05-24 · Red Hat rating Importantjbossas security update
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4) jbossas-4.0.5-2.CP04.el4s1.2
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4) jbossas-4.0.5-2.CP04.el4s1.2
- RHSA-2007:0328 Released 2007-05-24 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) jakarta-commons-modeler-2.0-3jpp_3rh, tomcat5-5.5.23-0jpp_6rh, tomcat5-common-lib-5.5.23-0jpp_6rh +4
- RHSA-2007:0326 Released 2007-05-21 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4ES jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4WS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- RHSA-2007:0327 Released 2007-05-14 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.ia64 +47
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-javadoc-1.1-8jpp.1.0.2.el5 +19
- RHSA-2007:0340 Released 2007-05-08 · Red Hat rating Importanttomcat security update
- Red Hat Application Server 3AS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3ES tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3WS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server 3AS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3ES | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3WS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server v2 4AS | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2007:0326 |
| Red Hat Application Stack v1 for Enterprise Linux AS (v.4) | Fixed | RHSA-2007:0360 |
| Red Hat Application Stack v1 for Enterprise Linux ES (v.4) | Fixed | RHSA-2007:0360 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2007:0328 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2007:0327 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2007:0327 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2007:0327 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0261 |
| Red Hat Satellite v 4.0 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
| Red Hat Satellite v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
Not affected: 2 products
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4)
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4)
Timeline
- 2026-10-02 Threatist record created from CVE-2007-0450
- 2026-10-03 Alias added: GHSA-4prh-gqw8-rgh5
References
Advisory 28
- http://tomcat.apache.org/security-4.html
- [Security-announce] 20080107 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1
- ADV-2007-2732
- 239312
- ADV-2007-3087
- ADV-2008-1979
- SUSE-SR:2007:005
- APPLE-SA-2007-07-31
- ADV-2008-0065
- RHSA-2007:0360
- ADV-2009-0233
- http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
- http://tomcat.apache.org/security-6.html
- ADV-2007-3386
- RHSA-2007:0327
- http://docs.info.apple.com/article.html?artnum=306172
- SSRT071447
- ADV-2007-0975
- http://tomcat.apache.org/security-5.html
- RHSA-2008:0261
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200702e.html
- GLSA-200705-03
- 2446
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
- MDKSA-2007:241
- SUSE-SR:2007:015
- oval:org.mitre.oval:def:10643
- https://nvd.nist.gov/vuln/detail/CVE-2007-0450
Other 25
- http://www.sec-consult.com/287.html
- http://www.sec-consult.com/fileadmin/Advisories/20070314-0-apache_tomcat_directory_traversal.txt
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/0c5ec5b958f1b59840ee155a23ab409755b039f6
- https://github.com/apache/tomcat/commit/19ec1ccd17fbb98511bc1c12b255253c4f48b85f
- https://github.com/apache/tomcat/commit/ec7ff880dbc28b313bf3a2b1914f6f0371489793
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Http Server vulnerabilities
- TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
- TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
- TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2007-0450 · CVE Program
- CVE-2007-0450 · NVD
- FIRST EPSS
- GHSA-4prh-gqw8-rgh5 · GitHub Advisory Database · CC BY 4.0
- CVE-2007-0450 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences