CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

99.71% chance of exploitation in the next 30 days, 100th percentile

Published

2008-08-13

Updated

2024-08-07

Proof-of-concept exploits (1)

• Naramsim/Offensive1★ · 2017-01-11

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/tomcat_utf8_traversa…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/14489
• https://www.exploit-db.com/exploits/6229

References

• CVE Record
• NVD entry

Related

• CVE-2014-1904
• CVE-2014-2064
• CVE-2016-1240
• CVE-2008-2936
• CVE-2008-2943
• CVE-2008-2935