Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/43146?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/43146?format=api", "vulnerability_id": "VCID-kxc3-vz2c-wqca", "summary": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\nAbsolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.", "aliases": [ { "alias": "CVE-2007-5461" }, { "alias": "GHSA-v5p2-vg3c-pmrr" } ], "fixed_packages": [], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61623?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@4.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2af1-rv9j-jugv" }, { "vulnerability": "VCID-2jws-wtvg-2khf" }, { "vulnerability": "VCID-aywp-amq3-yyes" }, { "vulnerability": "VCID-ccfn-tde4-s7hr" }, { "vulnerability": "VCID-hxer-p6va-7kdh" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-sjn3-a6fs-gyck" }, { "vulnerability": "VCID-w8uj-zy2r-fyca" }, { "vulnerability": "VCID-wpnp-3yad-ybcj" }, { "vulnerability": "VCID-zam7-79x3-ekg3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/61635?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@4.0.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jws-wtvg-2khf" }, { "vulnerability": "VCID-96yu-fvee-wfbs" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-sjn3-a6fs-gyck" }, { "vulnerability": "VCID-w8uj-zy2r-fyca" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.0.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/61616?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@4.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2af1-rv9j-jugv" }, { "vulnerability": "VCID-2jws-wtvg-2khf" }, { "vulnerability": "VCID-5jm8-9upn-g7f4" }, { "vulnerability": "VCID-7787-4bwm-efgq" }, { "vulnerability": "VCID-96yu-fvee-wfbs" }, { "vulnerability": "VCID-ccfn-tde4-s7hr" }, { "vulnerability": "VCID-crhe-rt8j-wycu" }, { "vulnerability": "VCID-eygg-nt7y-qubh" }, { "vulnerability": "VCID-hmqa-jhuf-hfe2" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-qz87-x4zb-rud7" }, { "vulnerability": "VCID-rdr4-db3y-p3cz" }, { "vulnerability": "VCID-sjn3-a6fs-gyck" }, { "vulnerability": "VCID-t4mh-zvhq-27du" }, { "vulnerability": "VCID-wg7f-pjmn-uudk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/61709?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@5.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-24v5-jpna-rqg9" }, { "vulnerability": "VCID-2af1-rv9j-jugv" }, { "vulnerability": "VCID-4t2h-jjhm-y7fq" }, { "vulnerability": "VCID-atus-ryef-17h1" }, { "vulnerability": "VCID-cqz2-4njt-g3da" }, { "vulnerability": "VCID-crhe-rt8j-wycu" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-qz87-x4zb-rud7" }, { "vulnerability": "VCID-w8uj-zy2r-fyca" }, { "vulnerability": "VCID-zam7-79x3-ekg3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/61691?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@5.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2af1-rv9j-jugv" }, { "vulnerability": "VCID-46sr-9kr3-1ubw" }, { "vulnerability": "VCID-74c7-a56p-kufz" }, { "vulnerability": "VCID-7787-4bwm-efgq" }, { "vulnerability": "VCID-89e9-m968-vfhe" }, { "vulnerability": "VCID-9hm5-e4dw-6ffe" }, { "vulnerability": "VCID-9j31-459b-4qbm" }, { "vulnerability": "VCID-cqz2-4njt-g3da" }, { "vulnerability": "VCID-eawm-8v9w-yfap" }, { "vulnerability": "VCID-eygg-nt7y-qubh" }, { "vulnerability": "VCID-fu9h-e3jx-abe2" }, { "vulnerability": "VCID-hmqa-jhuf-hfe2" }, { "vulnerability": "VCID-jw6e-g8z9-43ej" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-pzkk-4e94-aqag" }, { "vulnerability": "VCID-qz87-x4zb-rud7" }, { "vulnerability": "VCID-rdr4-db3y-p3cz" }, { "vulnerability": "VCID-t4mh-zvhq-27du" }, { "vulnerability": "VCID-w6ay-nzvg-zbff" }, { "vulnerability": "VCID-w8uj-zy2r-fyca" }, { "vulnerability": "VCID-wg7f-pjmn-uudk" }, { "vulnerability": "VCID-wtke-y2cx-x3et" }, { "vulnerability": "VCID-y9yv-u4jh-mqew" }, { "vulnerability": "VCID-yvcg-96dp-r7e6" }, { "vulnerability": "VCID-zm75-zwps-h3fv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/61743?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@5.5.25", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-qzyq-d6qk-67ag" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.25" }, { "url": "http://public2.vulnerablecode.io/api/packages/61688?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@6.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2kjh-4r2g-rqe6" }, { "vulnerability": "VCID-46sr-9kr3-1ubw" }, { "vulnerability": "VCID-4t2h-jjhm-y7fq" }, { "vulnerability": "VCID-5m85-3zyu-7qak" }, { "vulnerability": "VCID-6uuq-2a39-yubx" }, { "vulnerability": "VCID-74c7-a56p-kufz" }, { "vulnerability": "VCID-7787-4bwm-efgq" }, { "vulnerability": "VCID-89e9-m968-vfhe" }, { "vulnerability": "VCID-9hm5-e4dw-6ffe" }, { "vulnerability": "VCID-9j31-459b-4qbm" }, { "vulnerability": "VCID-aar2-398x-p3d8" }, { "vulnerability": "VCID-atus-ryef-17h1" }, { "vulnerability": "VCID-axzz-cadr-b7fv" }, { "vulnerability": "VCID-crhe-rt8j-wycu" }, { "vulnerability": "VCID-eawm-8v9w-yfap" }, { "vulnerability": "VCID-eygg-nt7y-qubh" }, { "vulnerability": "VCID-f4ka-47dk-zffs" }, { "vulnerability": "VCID-fu9h-e3jx-abe2" }, { "vulnerability": "VCID-fuxz-fqw3-ufa9" }, { "vulnerability": "VCID-hmqa-jhuf-hfe2" }, { "vulnerability": "VCID-hqzu-shyu-j3hp" }, { "vulnerability": "VCID-jw6e-g8z9-43ej" }, { "vulnerability": "VCID-kxc3-vz2c-wqca" }, { "vulnerability": "VCID-n4zk-mdyw-3fcz" }, { "vulnerability": "VCID-pq53-6deg-abfx" }, { "vulnerability": "VCID-pzkk-4e94-aqag" }, { "vulnerability": "VCID-qz87-x4zb-rud7" }, { "vulnerability": "VCID-qzyq-d6qk-67ag" }, { "vulnerability": "VCID-rdr4-db3y-p3cz" }, { "vulnerability": "VCID-redv-2x5y-8khx" }, { "vulnerability": "VCID-s37s-p75k-27e6" }, { "vulnerability": "VCID-t3ya-1w1r-h3dv" }, { "vulnerability": "VCID-t4mh-zvhq-27du" }, { "vulnerability": "VCID-tcmv-6ftg-fqen" }, { "vulnerability": "VCID-vsta-e8jg-4qa8" }, { "vulnerability": "VCID-w8uj-zy2r-fyca" }, { "vulnerability": "VCID-wg7f-pjmn-uudk" }, { "vulnerability": "VCID-wtke-y2cx-x3et" }, { "vulnerability": "VCID-y9yv-u4jh-mqew" }, { "vulnerability": "VCID-yswq-hnqg-sycs" }, { "vulnerability": "VCID-yvcg-96dp-r7e6" }, { "vulnerability": "VCID-zm75-zwps-h3fv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/61763?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@6.0.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-kxc3-vz2c-wqca" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.14" } ], "references": [ { "reference_url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html" }, { "reference_url": "http://issues.apache.org/jira/browse/GERONIMO-3549", "reference_id": "", "reference_type": "", "scores": [], "url": "http://issues.apache.org/jira/browse/GERONIMO-3549" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html" }, { "reference_url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3E" }, { "reference_url": "http://marc.info/?l=bugtraq&m=139344343412337&w=2", "reference_id": "", "reference_type": "", "scores": [], "url": "http://marc.info/?l=bugtraq&m=139344343412337&w=2" }, { "reference_url": "http://marc.info/?l=full-disclosure&m=119239530508382", "reference_id": "", "reference_type": "", "scores": [], "url": "http://marc.info/?l=full-disclosure&m=119239530508382" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html" }, { "reference_url": "http://security.gentoo.org/glsa/glsa-200804-10.xml", "reference_id": "", "reference_type": "", "scores": [], "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243", "reference_id": "", "reference_type": "", "scores": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243" }, { "reference_url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E" }, { "reference_url": "http://support.apple.com/kb/HT2163", "reference_id": "", "reference_type": "", "scores": [], "url": "http://support.apple.com/kb/HT2163" }, { "reference_url": "http://support.apple.com/kb/HT3216", "reference_id": "", "reference_type": "", "scores": [], "url": "http://support.apple.com/kb/HT3216" }, { "reference_url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html" }, { "reference_url": "http://tomcat.apache.org/security-4.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://tomcat.apache.org/security-4.html" }, { "reference_url": "http://tomcat.apache.org/security-5.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://tomcat.apache.org/security-5.html" }, { "reference_url": "http://tomcat.apache.org/security-6.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://tomcat.apache.org/security-6.html" }, { "reference_url": "http://www.debian.org/security/2008/dsa-1447", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.debian.org/security/2008/dsa-1447" }, { "reference_url": "http://www.debian.org/security/2008/dsa-1453", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.debian.org/security/2008/dsa-1453" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html" }, { "reference_url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5461", "reference_id": "CVE-2007-5461", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5461" }, { "reference_url": "https://github.com/advisories/GHSA-v5p2-vg3c-pmrr", "reference_id": "GHSA-v5p2-vg3c-pmrr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v5p2-vg3c-pmrr" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 22, "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory." }, { "cwe_id": 352, "name": "Cross-Site Request Forgery (CSRF)", "description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kxc3-vz2c-wqca" }