GHSA-hhjg-g8xq-hhr3

Source

https://github.com/advisories/GHSA-hhjg-g8xq-hhr3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hhjg-g8xq-hhr3/GHSA-hhjg-g8xq-hhr3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhjg-g8xq-hhr3

Aliases

CVE-2009-0783

Published

2022-05-02T03:18:15Z

Modified

2023-11-08T03:56:52.967145Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Details

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

Database specific

{
    "nvd_published_at": "2009-06-05T16:00:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T22:00:02Z"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Last affected

4.1.39

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.5.0

Last affected

5.5.27

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.0.20

Database specific

{
    "last_known_affected_version_range": "<= 6.0.18"
}