CVE-2009-0783

low-risk
Published 2009-06-05

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.2/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (94)

Mailing List http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
Third Party Advisory http://marc.info/?l=bugtraq&m=127420533226623&w=2
Third Party Advisory http://marc.info/?l=bugtraq&m=129070310906557&w=2
Third Party Advisory http://marc.info/?l=bugtraq&m=136485229118404&w=2
Vendor Advisory http://secunia.com/advisories/35685
Vendor Advisory http://secunia.com/advisories/35788
Vendor Advisory http://secunia.com/advisories/37460
Vendor Advisory http://secunia.com/advisories/42368
Third Party Advisory http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1
Third Party Advisory http://support.apple.com/kb/HT4077
Patch http://svn.apache.org/viewvc?rev=652592&view=rev
Patch http://svn.apache.org/viewvc?rev=681156&view=rev
Patch http://svn.apache.org/viewvc?rev=739522&view=rev
Patch http://svn.apache.org/viewvc?rev=781542&view=rev
Patch http://svn.apache.org/viewvc?rev=781708&view=rev
Patch http://tomcat.apache.org/security-4.html
Patch http://tomcat.apache.org/security-5.html
Patch http://tomcat.apache.org/security-6.html
Third Party Advisory http://www.debian.org/security/2011/dsa-2207
and 74 more references
20
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal