CVE-2007-0450

描述

Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a `..` (dot dot) sequence with combinations of (1) `/` (slash), (2) `\` (backslash), and (3) URL-encoded backslash (`%5C`) characters in the URL, which are valid separators in Tomcat but not in Apache.

如何修補 CVE-2007-0450

要修補 CVE-2007-0450,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 5.5.22 或更新版本

CVE-2007-0450 正在被利用嗎?

可能 — EPSS 為 90.8%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• >= 5.0, < 5.5.22

參考連結(34)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-0450
• PATCHgithub.com/apache/tomcat
• WEBdocs.info.apple.com/article.html?artnum=306172
• WEBlists.apple.com/archives/security-announce//2007/Jul/msg00004.html
• WEB