Strix
26.1K

CVE-2008-2938

UnknownEPSS 99.71%

Last modified

CVE-2008-2938 is a vulnerability of currently unknown severity. Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.. EPSS estimates a 99.71% chance of exploitation in the next 30 days.

Description

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Metrics

EPSS Probability
99.71%

100.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheTomcat>= 4.0.0, <= 4.1.37
ApacheTomcat>= 5.0.0, <= 5.5.26
ApacheTomcat>= 6.0.0, <= 6.0.16

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2008-2938?
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
How severe is CVE-2008-2938?
Severity scoring for CVE-2008-2938 is pending analysis. The EPSS model estimates a 99.71% probability of exploitation in the next 30 days.
How do I fix CVE-2008-2938?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-2938?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST