CVE-2010-3718 in Tomcat
Summary
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
10/01/2010
Disclosure
02/10/2011
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 4283 | Apache Tomcat ServletContect privileges management | 269 | Not defined | Official fix | CVE-2010-3718 |