Description
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_2.1 | RHSA-2008:0648 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_12rh | RHSA-2008:0864 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_12rh | RHSA-2008:1007 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-5.CP07.0jpp.ep1.1.el4 | RHSA-2008:0877 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure EDB-32137 · remote · Aug 1, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.38 | 4.1.38 | GHSA-m8h8-6rvg-f4mg |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.27 | 5.5.27 | GHSA-m8h8-6rvg-f4mg |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.18 | 6.0.18 | GHSA-m8h8-6rvg-f4mg |
Advisories 6
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0648 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:1007 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0864 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0877 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 30494 vdb-entry
- http://tomcat.apache.org/security-4.html
- 20080801 [CVE-2008-2370] Apache Tomcat information disclosure vulnerability mailing-list
- oval:org.mitre.oval:def:10577 vdb-entry signature
- ADV-2009-1535 vdb-entry
- RHSA-2008:0862 vendor-advisory
- 34013 third-party-advisory
- ADV-2008-2823 vdb-entry
- 37460 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html
- 31982 third-party-advisory
- 31681 vdb-entry
- 32120 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 33999 third-party-advisory
- 31865 third-party-advisory
- oval:org.mitre.oval:def:5876 vdb-entry signature
- 4099 third-party-advisory
- FEDORA-2008-8130 vendor-advisory
- 31639 third-party-advisory
- SUSE-SR:2008:018 vendor-advisory
- MDVSA-2008:188 vendor-advisory
- 31379 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- RHSA-2008:0864 vendor-advisory
- tomcat-requestdispatcher-info-disclosure(44156) vdb-entry
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 35393 third-party-advisory
- 57126 third-party-advisory
- 32222 third-party-advisory
- 36249 third-party-advisory
- 31891 third-party-advisory
- 33797 third-party-advisory
- 1020623 vdb-entry
- FEDORA-2008-7977 vendor-advisory
- ADV-2008-2305 vdb-entry
- FEDORA-2008-8113 vendor-advisory
- http://tomcat.apache.org/security-5.html
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html
- ADV-2008-2780 vdb-entry
- 31381 third-party-advisory
- HPSBUX02401 vendor-advisory
- HPSBST02955 vendor-advisory
- ADV-2009-2215 vdb-entry
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- ADV-2009-0503 vdb-entry
- ADV-2009-3316 vdb-entry
- 32266 third-party-advisory
- RHSA-2008:0648 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list