CVE-2009-2901

描述

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

如何修補 CVE-2009-2901

要修補 CVE-2009-2901,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 5.5.29 或更新版本

CVE-2009-2901 正在被利用嗎?

中等 — EPSS 為 8.2%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 5.5.0, < 5.5.29

參考連結(24)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2009-2901
• PATCHgithub.com/apache/tomcat
• WEBlists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
• WEBlists.opensuse.org/opensuse-updates/2012-12/msg00089.html
• WEB