Apache Tomcat < 5.5.23 / 6.0.10 Directory Traversal Arbitrary File Access

Medium Nessus Network Monitor Plugin ID 3949


The remote host is vulnerable to a directory traversal flaw.


The remote host is running the Apache Tomcat server. This version of Tomcat is vulnerable to a directory traversal flaw. An attacker exploiting this flaw would only need to be able to send a malformed request to the server. Successful exploitation would result in the attacker being able to read arbitrary files with the permission of the web server process. This can lead to disclosure of source code or confidential data.


Upgrade to version 5.5.23, 6.0.10 or higher.

See Also


Plugin Details

Severity: Medium

ID: 3949

File Name: 3949.prm

Family: Web Servers

Published: 2007/03/14

Modified: 2016/01/21

Dependencies: 1442

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 5.3

Temporal Score: 4.9


Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:tomcat

Reference Information

CVE: CVE-2007-0450

BID: 22960