Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong…
Priority LOW 34CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
Why it matters now
EPSS 0.05016 92nd percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 6.0.16Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.16 | 6.0.16 | Patch available | GHSA-5x5f-9r6q-q7mh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.16 Fixed in 6.0.16 Patch available GHSA-5x5f-9r6q-q7mh
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
Remediation
- Fix · GHSA-5x5f-9r6q-q7mh org.apache.tomcat:tomcat (Maven) Fixed in 6.0.16 Advisory →
Red Hat 3 advisories
- RHSA-2008:0151 Released 2008-04-02 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.2.0CP02 security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS glassfish-javamail-1.4.0-0jpp.ep1.8, hibernate3-1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.2.el4 +22
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES glassfish-javamail-1.4.0-0jpp.ep1.8, hibernate3-1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.2.el4 +22
- RHSA-2008:0213 Released 2008-04-02 · Red Hat rating ModerateJBoss Enterprise Application Platform 4.2.0CP02 security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server hibernate3-3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1, hibernate3-annotations-3.2.1-1.patch02.1jpp.ep1.2.el5.1, hibernate3-annotations-javadoc-3.2.1-1.patch02.1jpp.ep1.2.el5.1 +13
- RHSA-2008:0158 Released 2008-03-24 · Red Hat rating ModerateJBoss Enterprise Application Platform security update
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4) concurrent-1.3.4-7jpp.ep1.6.el4, glassfish-jaf-1.1.0-0jpp.ep1.10.el4, glassfish-javamail-1.4.0-0jpp.ep1.8 +26
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4) concurrent-1.3.4-7jpp.ep1.6.el4, glassfish-jaf-1.1.0-0jpp.ep1.10.el4, glassfish-javamail-1.4.0-0jpp.ep1.8 +26
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Stack v1 for Enterprise Linux AS (v.4) | Fixed | RHSA-2008:0158 |
| Red Hat Application Stack v1 for Enterprise Linux ES (v.4) | Fixed | RHSA-2008:0158 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS | Fixed | RHSA-2008:0151 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES | Fixed | RHSA-2008:0151 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server | Fixed | RHSA-2008:0213 |
Not affected: 6 products
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4)
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4)
- Red Hat Application Stack v2 for Enterprise Linux (v.5)
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server
Timeline
- 2026-10-02 Threatist record created from CVE-2008-0002
- 2026-10-03 Alias added: GHSA-5x5f-9r6q-q7mh
References
Advisory 8
Other 18
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- ADV-2008-0488
- http://tomcat.apache.org/security-6.html
- ADV-2008-2780
- http://support.apple.com/kb/HT3216
- ADV-2009-3316
- https://github.com/apache/tomcat
- https://web.archive.org/web/20080214133036/http://secunia.com/advisories/28915
- https://web.archive.org/web/20080715062302/http://secunia.com/advisories/29711
- https://web.archive.org/web/20080724052339/http://secunia.com/advisories/28834
- https://web.archive.org/web/20081012021650/http://www.securityfocus.com/bid/27703
- https://web.archive.org/web/20081013050642/http://secunia.com/advisories/32222
- https://web.archive.org/web/20081120062646/http://securityreason.com/securityalert/3638
- https://web.archive.org/web/20081121133027/http://www.securityfocus.com/archive/1/487812/100/0/threaded
- https://web.archive.org/web/20091125140215/http://secunia.com/advisories/37460
- https://web.archive.org/web/20120825080137/http://www.securityfocus.com/bid/31681
- https://web.archive.org/web/20140723000733/http://secunia.com/advisories/57126
- https://web.archive.org/web/20150621204350/http://www.securityfocus.com/archive/1/507985/100/0/threaded
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2008-0002 · CVE Program
- CVE-2008-0002 · NVD
- FIRST EPSS
- GHSA-5x5f-9r6q-q7mh · GitHub Advisory Database · CC BY 4.0
- CVE-2008-0002 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences