CVE-2009-2693

描述

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a `..` (dot dot) in an entry in a WAR file, as demonstrated by a `../../bin/catalina.bat` entry.

如何修補 CVE-2009-2693

要修補 CVE-2009-2693,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 5.5.29 或更新版本

CVE-2009-2693 正在被利用嗎?

中等 — EPSS 為 9.6%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 5.5.0, < 5.5.29

參考連結(38)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2009-2693
• PATCHgithub.com/apache/tomcat
• WEBlists.apple.com/archives/security-announce/2010//Mar/msg00001.html
• WEBlists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html