Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a…
Priority LOW 10CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Why it matters now
EPSS 0.013 70th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 7.0.4, 6.0.30, 5.5.30Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 7.0.0 to before 7.0.4 | 7.0.4 | Patch available | GHSA-fj6c-prgj-gr3r |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.30 | 6.0.30 | Patch available | GHSA-fj6c-prgj-gr3r |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.30 | 5.5.30 | Patch available | GHSA-fj6c-prgj-gr3r |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.4 Fixed in 7.0.4 Patch available GHSA-fj6c-prgj-gr3r
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.30 Fixed in 6.0.30 Patch available GHSA-fj6c-prgj-gr3r
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.30 Fixed in 5.5.30 Patch available GHSA-fj6c-prgj-gr3r
CPE configurations NVD · 63
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* | 7.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* | 7.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
Show 53 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* | 6.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* | 6.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* | 6.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* | 6.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* | 6.0.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* | 6.0.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* | 6.0.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* | 6.0.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* | 6.0.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* | 5.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* | 5.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* | 5.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* | 5.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* | 5.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* | 5.5.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* | 5.5.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* | 5.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* | 5.5.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* | 5.5.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* | 5.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* | 5.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* | 5.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* | 5.5.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* | 5.5.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* | 5.5.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* | 5.5.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* | 5.5.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* | 5.5.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* | 5.5.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* | 5.5.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* | 5.5.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* | 5.5.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* | 5.5.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* | 5.5.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* | 5.5.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* | 5.5.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* | 5.5.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* | 5.5.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:* | 5.5.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:* | 5.5.30 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:* | 5.5.32 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.29:*:*:*:*:*:*:* Versions 5.5.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.30:*:*:*:*:*:*:* Versions 5.5.30 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.32:*:*:*:*:*:*:* Versions 5.5.32 Vulnerable ·Apache
Remediation
- Fix · GHSA-fj6c-prgj-gr3r org.apache.tomcat:tomcat (Maven) Fixed in 7.0.4 Advisory →
- Fix · GHSA-fj6c-prgj-gr3r org.apache.tomcat:tomcat (Maven) Fixed in 6.0.30 Advisory →
- Fix · GHSA-fj6c-prgj-gr3r org.apache.tomcat:tomcat (Maven) Fixed in 5.5.30 Advisory →
Red Hat 4 advisories
- RHSA-2011:1845 Released 2011-12-20 · Red Hat rating Moderatetomcat5 security update
- RHEL Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.22.el5_7, tomcat5-5.5.23-0jpp.22.el5_7.i386, tomcat5-admin-webapps-5.5.23-0jpp.22.el5_7 +15
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.22.el5_7, tomcat5-5.5.23-0jpp.22.el5_7.i386, tomcat5-5.5.23-0jpp.22.el5_7.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.22.el5_7, tomcat5-jsp-2.0-api-5.5.23-0jpp.22.el5_7, tomcat5-jsp-2.0-api-5.5.23-0jpp.22.el5_7.i386 +2
- RHSA-2011:0897 Released 2011-06-22 · Red Hat rating ModerateJBoss Enterprise Web Server 1.0.2 update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server ant-1.7.1-13.jdk6.ep5.el5, ant-antlr-1.7.1-13.jdk6.ep5.el5, ant-apache-bcel-1.7.1-13.jdk6.ep5.el5 +47
- Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server ant-1.7.1-14.ep5.el6, ant-antlr-1.7.1-14.ep5.el6, ant-apache-bcel-1.7.1-14.ep5.el6 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES ant-1.7.1-13.jdk6.ep5.el4, antlr-2.7.7-7.ep5.el4, bcel-5.2-8.1.ep5.el4 +47
- RHSA-2011:0896 Released 2011-06-22 · Red Hat rating ModerateJBoss Enterprise Web Server 1.0.2 update
- Red Hat JBoss Web Server 1.0
Show 1 more Red Hat advisories
- RHSA-2011:0791 Released 2011-05-19 · Red Hat rating Moderatetomcat6 security and bug fix update
- Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +6
- Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-33.el6, tomcat6-el-2.1-api-6.0.24-33.el6, tomcat6-jsp-2.1-api-6.0.24-33.el6 +2
- Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +2
- Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-33.el6, tomcat6-el-2.1-api-6.0.24-33.el6, tomcat6-jsp-2.1-api-6.0.24-33.el6 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-33.el6, tomcat6-admin-webapps-6.0.24-33.el6, tomcat6-docs-webapp-6.0.24-33.el6 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHEL Desktop Workstation (v. 5 client) | Fixed | RHSA-2011:1845 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2011:1845 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2011:1845 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2011:0791 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1.0 | Fixed | RHSA-2011:0896 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2011:0897 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2011:0897 |
Timeline
- 2026-10-02 Threatist record created from CVE-2010-3718
- 2026-10-03 Alias added: GHSA-fj6c-prgj-gr3r
References
Advisory 17
- 8072
- http://tomcat.apache.org/security-6.html
- HPSBUX02860
- RHSA-2011:1845
- SUSE-SR:2011:005
- SSRT100627
- APPLE-SA-2011-10-12-3
- MDVSA-2011:030
- RHSA-2011:0897
- RHSA-2011:0791
- RHSA-2011:0896
- DSA-2160
- http://tomcat.apache.org/security-5.html
- HPSBUX02645
- HPSBST02955
- http://tomcat.apache.org/security-7.html
- https://nvd.nist.gov/vuln/detail/CVE-2010-3718
Other 23
- oval:org.mitre.oval:def:13969
- oval:org.mitre.oval:def:19379
- http://support.apple.com/kb/HT5002
- oval:org.mitre.oval:def:12517
- http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/a697f7b52c4e3aea0c6763b33d413b54a518e883
- https://github.com/apache/tomcat55/commit/53b9e4bf21aef92321404644bfbb22ae625c033b
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30
- https://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.0.30
- https://marc.info/?l=bugtraq&m=139344343412337&w=2
- https://marc.info/?l=bugtraq&m=136485229118404&w=2
- https://marc.info/?l=bugtraq&m=132215163318824&w=2
- https://marc.info/?l=bugtraq&m=130168502603566&w=2
- https://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- https://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2010-3718 · CVE Program
- CVE-2010-3718 · NVD
- FIRST EPSS
- GHSA-fj6c-prgj-gr3r · GitHub Advisory Database · CC BY 4.0
- CVE-2010-3718 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences