{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43100?format=json","vulnerability_id":"VCID-t3ya-1w1r-h3dv","summary":"Apache Tomcat Sensitive Information Disclosure\nApache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.","aliases":[{"alias":"CVE-2008-0002"},{"alias":"GHSA-5x5f-9r6q-q7mh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61689?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-t4mh-zvhq-27du"},{"vulnerability":"VCID-wg7f-pjmn-uudk"},{"vulnerability":"VCID-y9hs-ymcm-3ucx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.16"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61688?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2kjh-4r2g-rqe6"},{"vulnerability":"VCID-46sr-9kr3-1ubw"},{"vulnerability":"VCID-4t2h-jjhm-y7fq"},{"vulnerability":"VCID-5m85-3zyu-7qak"},{"vulnerability":"VCID-6uuq-2a39-yubx"},{"vulnerability":"VCID-74c7-a56p-kufz"},{"vulnerability":"VCID-7787-4bwm-efgq"},{"vulnerability":"VCID-89e9-m968-vfhe"},{"vulnerability":"VCID-9hm5-e4dw-6ffe"},{"vulnerability":"VCID-9j31-459b-4qbm"},{"vulnerability":"VCID-aar2-398x-p3d8"},{"vulnerability":"VCID-atus-ryef-17h1"},{"vulnerability":"VCID-axzz-cadr-b7fv"},{"vulnerability":"VCID-crhe-rt8j-wycu"},{"vulnerability":"VCID-eawm-8v9w-yfap"},{"vulnerability":"VCID-eygg-nt7y-qubh"},{"vulnerability":"VCID-f4ka-47dk-zffs"},{"vulnerability":"VCID-fu9h-e3jx-abe2"},{"vulnerability":"VCID-fuxz-fqw3-ufa9"},{"vulnerability":"VCID-hmqa-jhuf-hfe2"},{"vulnerability":"VCID-hqzu-shyu-j3hp"},{"vulnerability":"VCID-jw6e-g8z9-43ej"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-n4zk-mdyw-3fcz"},{"vulnerability":"VCID-pq53-6deg-abfx"},{"vulnerability":"VCID-pzkk-4e94-aqag"},{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-qzyq-d6qk-67ag"},{"vulnerability":"VCID-rdr4-db3y-p3cz"},{"vulnerability":"VCID-redv-2x5y-8khx"},{"vulnerability":"VCID-s37s-p75k-27e6"},{"vulnerability":"VCID-t3ya-1w1r-h3dv"},{"vulnerability":"VCID-t4mh-zvhq-27du"},{"vulnerability":"VCID-tcmv-6ftg-fqen"},{"vulnerability":"VCID-vsta-e8jg-4qa8"},{"vulnerability":"VCID-w8uj-zy2r-fyca"},{"vulnerability":"VCID-wg7f-pjmn-uudk"},{"vulnerability":"VCID-wtke-y2cx-x3et"},{"vulnerability":"VCID-y9yv-u4jh-mqew"},{"vulnerability":"VCID-yswq-hnqg-sycs"},{"vulnerability":"VCID-yvcg-96dp-r7e6"},{"vulnerability":"VCID-zm75-zwps-h3fv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.0"}],"references":[{"reference_url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"},{"reference_url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","reference_id":"","reference_type":"","scores":[],"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2"},{"reference_url":"http://security.gentoo.org/glsa/glsa-200804-10.xml","reference_id":"","reference_type":"","scores":[],"url":"http://security.gentoo.org/glsa/glsa-200804-10.xml"},{"reference_url":"http://support.apple.com/kb/HT3216","reference_id":"","reference_type":"","scores":[],"url":"http://support.apple.com/kb/HT3216"},{"reference_url":"https://web.archive.org/web/20080214133036/http://secunia.com/advisories/28915","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20080214133036/http://secunia.com/advisories/28915"},{"reference_url":"https://web.archive.org/web/20080715062302/http://secunia.com/advisories/29711","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20080715062302/http://secunia.com/advisories/29711"},{"reference_url":"https://web.archive.org/web/20080724052339/http://secunia.com/advisories/28834","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20080724052339/http://secunia.com/advisories/28834"},{"reference_url":"https://web.archive.org/web/20081012021650/http://www.securityfocus.com/bid/27703","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20081012021650/http://www.securityfocus.com/bid/27703"},{"reference_url":"https://web.archive.org/web/20081013050642/http://secunia.com/advisories/32222","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20081013050642/http://secunia.com/advisories/32222"},{"reference_url":"https://web.archive.org/web/20081120062646/http://securityreason.com/securityalert/3638","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20081120062646/http://securityreason.com/securityalert/3638"},{"reference_url":"https://web.archive.org/web/20081121133027/http://www.securityfocus.com/archive/1/487812/100/0/threaded","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20081121133027/http://www.securityfocus.com/archive/1/487812/100/0/threaded"},{"reference_url":"https://web.archive.org/web/20091125140215/http://secunia.com/advisories/37460","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20091125140215/http://secunia.com/advisories/37460"},{"reference_url":"https://web.archive.org/web/20120825080137/http://www.securityfocus.com/bid/31681","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20120825080137/http://www.securityfocus.com/bid/31681"},{"reference_url":"https://web.archive.org/web/20140723000733/http://secunia.com/advisories/57126","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20140723000733/http://secunia.com/advisories/57126"},{"reference_url":"https://web.archive.org/web/20150621204350/http://www.securityfocus.com/archive/1/507985/100/0/threaded","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20150621204350/http://www.securityfocus.com/archive/1/507985/100/0/threaded"},{"reference_url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html"},{"reference_url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html"},{"reference_url":"http://tomcat.apache.org/security-6.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-6.html"},{"reference_url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0002","reference_id":"CVE-2008-0002","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0002"},{"reference_url":"https://github.com/advisories/GHSA-5x5f-9r6q-q7mh","reference_id":"GHSA-5x5f-9r6q-q7mh","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-5x5f-9r6q-q7mh"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t3ya-1w1r-h3dv"}