Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through…
Priority LOW 33CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
Why it matters now
EPSS 0.10741 95th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.29, 6.0.24Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.29 | 5.5.29 | Patch available | GHSA-8wch-9gcg-v2pr |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.24 | 6.0.24 | Patch available | GHSA-8wch-9gcg-v2pr |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.29 Fixed in 5.5.29 Patch available GHSA-8wch-9gcg-v2pr
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.24 Fixed in 6.0.24 Patch available GHSA-8wch-9gcg-v2pr
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* | 5.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* | 5.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* | 5.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* | 5.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* | 5.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* | 5.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* | 5.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* | 5.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* | 5.5.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* | 5.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* | 5.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* | 5.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* | 5.5.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* | 5.5.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* | 5.5.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* | 5.5.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* | 5.5.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* | 5.5.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* | 5.5.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* | 5.5.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* | 5.5.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* | 5.5.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* | 5.5.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* | 5.5.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* | 5.5.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* | 5.5.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* | 5.5.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* | 5.5.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* | 6.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* | 6.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* | 6.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* | 6.0.20 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
Remediation
- Fix · GHSA-8wch-9gcg-v2pr org.apache.tomcat:tomcat (Maven) Fixed in 5.5.29 Advisory →
- Fix · GHSA-8wch-9gcg-v2pr org.apache.tomcat:tomcat (Maven) Fixed in 6.0.24 Advisory →
Red Hat 4 advisories
- RHSA-2010:0693 Released 2010-09-10 · Red Hat rating Importanttomcat5 security update
- Red Hat Certificate System 7.3 for 4AS tomcat5-5.5.23-0jpp_4rh.19, tomcat5-common-lib-5.5.23-0jpp_4rh.19, tomcat5-jasper-5.5.23-0jpp_4rh.19 +3
- Red Hat Certificate System 7.3 for 4ES tomcat5-5.5.23-0jpp_4rh.19, tomcat5-common-lib-5.5.23-0jpp_4rh.19, tomcat5-jasper-5.5.23-0jpp_4rh.19 +3
- RHSA-2010:0582 Released 2010-08-02 · Red Hat rating Importanttomcat5 security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.17, tomcat5-admin-webapps-5.5.23-0jpp_4rh.17, tomcat5-common-lib-5.5.23-0jpp_4rh.17 +8
- RHSA-2010:0580 Released 2010-08-02 · Red Hat rating Importanttomcat5 security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-5.5.23-0jpp.9.el5_5.i386, tomcat5-5.5.23-0jpp.9.el5_5.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-jsp-2.0-api-5.5.23-0jpp.9.el5_5, tomcat5-jsp-2.0-api-5.5.23-0jpp.9.el5_5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.9.el5_5, tomcat5-5.5.23-0jpp.9.el5_5.i386, tomcat5-admin-webapps-5.5.23-0jpp.9.el5_5 +15
Show 1 more Red Hat advisories
- RHSA-2010:0119 Released 2010-02-23 · Red Hat rating LowJBoss Enterprise Web Server 1.0.1 update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server glassfish-jsf-1.2_13-3.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5.i386 +40
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2010:0582 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2010:0582 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2010:0582 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0693 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0693 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2010:0580 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2010:0580 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2010:0580 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2010:0119 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2902
- 2026-10-03 Alias added: GHSA-8wch-9gcg-v2pr
References
Advisory 18
Other 43
- http://svn.apache.org/viewvc?rev=892815&view=rev
- oval:org.mitre.oval:def:19431
- ADV-2010-1559
- ADV-2010-1986
- http://tomcat.apache.org/security-6.html
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://support.apple.com/kb/HT4077
- http://tomcat.apache.org/security-5.html
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- oval:org.mitre.oval:def:7092
- ADV-2010-0213
- http://svn.apache.org/viewvc?rev=902650&view=rev
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6
- https://github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421
- https://web.archive.org/web/20150308000602/http://www.securityfocus.com/archive/1/509150/100/0/threaded
- https://web.archive.org/web/20140515000000*/http://secunia.com/advisories/57126
- https://web.archive.org/web/20121211195847/http://www.securityfocus.com/bid/37945
- https://web.archive.org/web/20121211115829/http://securitytracker.com/id?1023504
- https://web.archive.org/web/20111119150528/http://www.securityfocus.com/archive/1/516397/100/0/threaded
- https://web.archive.org/web/20110601000000*/http://secunia.com/advisories/40330
- https://web.archive.org/web/20110529135656/http://secunia.com/advisories/38541
- https://web.archive.org/web/20110213053623/https://secunia.com/advisories/43310
- https://web.archive.org/web/20100601000000*/http://secunia.com/advisories/40813
- https://web.archive.org/web/20100412065745/http://secunia.com/advisories/39317
- https://web.archive.org/web/20100329100145/http://secunia.com/advisories/38687
- https://web.archive.org/web/20100127190258/http://secunia.com/advisories/38316
- https://web.archive.org/web/20100127015355/http://secunia.com/advisories/38346
- https://support.hpe.com/hpesc/public/docDisplay?docId=c02241113
- https://support.apple.com/kb/HT4077
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7092
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:19431
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
- https://access.redhat.com/errata/RHSA-2010:0582
- https://access.redhat.com/errata/RHSA-2010:0580
- https://access.redhat.com/errata/RHSA-2010:0119
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2009-2902 · CVE Program
- CVE-2009-2902 · NVD
- FIRST EPSS
- GHSA-8wch-9gcg-v2pr · GitHub Advisory Database · CC BY 4.0
- CVE-2009-2902 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences