Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through…
Priority LOW 38CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
Why it matters now
EPSS 0.09638 95th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.29, 6.0.24Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.29 | 5.5.29 | Patch available | GHSA-ggx9-4728-588r |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.24 | 6.0.24 | Patch available | GHSA-ggx9-4728-588r |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.29 Fixed in 5.5.29 Patch available GHSA-ggx9-4728-588r
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.24 Fixed in 6.0.24 Patch available GHSA-ggx9-4728-588r
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* | 5.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* | 5.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* | 5.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* | 5.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* | 5.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* | 5.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* | 5.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* | 5.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* | 5.5.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* | 5.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* | 5.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* | 5.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* | 5.5.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* | 5.5.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* | 5.5.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* | 5.5.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* | 5.5.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* | 5.5.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* | 5.5.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* | 5.5.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* | 5.5.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* | 5.5.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* | 5.5.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* | 5.5.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* | 5.5.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* | 5.5.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* | 5.5.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* | 5.5.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* | 6.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* | 6.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* | 6.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* | 6.0.20 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
Remediation
- Fix · GHSA-ggx9-4728-588r org.apache.tomcat:tomcat (Maven) Fixed in 5.5.29 Advisory →
- Fix · GHSA-ggx9-4728-588r org.apache.tomcat:tomcat (Maven) Fixed in 6.0.24 Advisory →
Red Hat 4 advisories
- RHSA-2010:0693 Released 2010-09-10 · Red Hat rating Importanttomcat5 security update
- Red Hat Certificate System 7.3 for 4AS tomcat5-5.5.23-0jpp_4rh.19, tomcat5-common-lib-5.5.23-0jpp_4rh.19, tomcat5-jasper-5.5.23-0jpp_4rh.19 +3
- Red Hat Certificate System 7.3 for 4ES tomcat5-5.5.23-0jpp_4rh.19, tomcat5-common-lib-5.5.23-0jpp_4rh.19, tomcat5-jasper-5.5.23-0jpp_4rh.19 +3
- RHSA-2010:0582 Released 2010-08-02 · Red Hat rating Importanttomcat5 security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- RHSA-2010:0580 Released 2010-08-02 · Red Hat rating Importanttomcat5 security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-5.5.23-0jpp.9.el5_5.i386, tomcat5-5.5.23-0jpp.9.el5_5.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-jsp-2.0-api-5.5.23-0jpp.9.el5_5, tomcat5-jsp-2.0-api-5.5.23-0jpp.9.el5_5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-5.5.23-0jpp.9.el5_5.i386, tomcat5-admin-webapps-5.5.23-0jpp.9.el5_5 +15
Show 1 more Red Hat advisories
- RHSA-2010:0119 Released 2010-02-23 · Red Hat rating LowJBoss Enterprise Web Server 1.0.1 update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server glassfish-jsf-1.2_13-3.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5.i386 +40
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2010:0582 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2010:0582 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2010:0582 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0693 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0693 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2010:0580 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2010:0580 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2010:0580 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2010:0119 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2693
- 2026-10-03 Alias added: GHSA-ggx9-4728-588r
References
Patch 4
Advisory 18
Other 28
- ADV-2010-1559
- ADV-2010-1986
- oval:org.mitre.oval:def:7017
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://support.apple.com/kb/HT4077
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- oval:org.mitre.oval:def:19355
- http://svn.apache.org/viewvc?rev=902650&view=rev
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6
- https://github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421
- https://web.archive.org/web/20201206235536/http://www.securityfocus.com/archive/1/509148/100/0/threaded
- https://web.archive.org/web/20200516121700/http://www.securityfocus.com/archive/1/516397/100/0/threaded
- https://web.archive.org/web/20200229071135/http://www.securityfocus.com/bid/37944
- https://support.hpe.com/hpesc/public/docDisplay?docId=c02241113
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7017
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:19355
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
- https://access.redhat.com/errata/RHSA-2010:0582
- https://access.redhat.com/errata/RHSA-2010:0580
- https://access.redhat.com/errata/RHSA-2010:0119
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2009-2693 · CVE Program
- CVE-2009-2693 · NVD
- FIRST EPSS
- GHSA-ggx9-4728-588r · GitHub Advisory Database · CC BY 4.0
- CVE-2009-2693 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences