Skip to content
OpenAdvisories
Unscored RHSA-2008:0877 3 CVEs

Red Hat Security Advisory: jbossweb security update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el4 jbossweb 0:2.0.0-5.CP07.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.2.0::el5 jbossweb 0:2.0.0-5.CP07.0jpp.ep1.1.el5
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el4 jbossweb 0:2.0.0-5.CP07.0jpp.ep1.1.el4
Red Hat · JBoss EAP 4 jboss_enterprise_application_platform:4.3.0::el5 jbossweb 0:2.0.0-5.CP07.0jpp.ep1.1.el5

Vulnerabilities 3

  • Medium —
    CVE-2008-1232 Public exploit EPSS 76%

    Apache Tomcat Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the Http…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2008-2370 Public exploit EPSS 53%

    Apache Tomcat Path Traversal Vulnerability

    Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attac…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2008-2938 Public exploit EPSS 100%

    Apache Tomcat Directory Traversal vulnerability

    Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the …

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=456120
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=457934
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0877.json
  • report
    https://access.redhat.com/security/cve/CVE-2008-1232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=457597
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-1232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-1232
  • report
    https://access.redhat.com/security/cve/CVE-2008-2370
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-2370
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-2370
  • report
    https://access.redhat.com/security/cve/CVE-2008-2938
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-2938
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-2938