CVE-2010-3718 — Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Description

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 6.0	tomcat6	6.0.28-9+squeeze1	DSA-2160-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 6	tomcat6 +8	6.0.24-33.el6	RHSA-2011:0791
RHEL 5	tomcat5 +10	5.5.23-0jpp.22.el5_7	RHSA-2011:1845

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 1	ant	1.7.1-13.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ant-commons-net	1.7.1-14.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	ant-jmf +16	1.7.1-13.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	antlr	2.7.7-7.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	bcel	5.2-8.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	cglib	2.2-5.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	dom4j	1.6.1-11.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ecj	1:3.3.1.1-3.2.2.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ecj3	1:3.3.1.1-3.1.1.1.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-jaf	1.1.0-6.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-javamail	1.4.2-0.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-jsf	1.2_13-2.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3 +1	1:3.3.2-1.4.GA_CP04.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-annotations +1	3.4.0-3.2.GA_CP04.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-commons-annotations +1	3.1.0-1.8.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-ejb-persistence-3.0-api +1	1:1.0.2-3.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-entitymanager +1	3.4.0-4.3.GA_CP04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd +2	2.2.17-11.1.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd-tools	2.2.17-11.2.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd22 +6	2.2.17-14.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-beanutils	1.8.0-4.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-chain	1.2-2.2.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-codec	1.3-9.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-collections +1	3.2.1-4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-daemon	1:1.0.5-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-daemon-jsvc	1:1.0.5-1.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-dbcp +1	1.2.1-16.2.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-digester	1.8.1-8.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-el	1.0-19.2.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-fileupload	1:1.1.1-7.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-httpclient	1:3.1-1.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-io	1.4-1.3.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-launcher	1.1-4.6.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-logging +1	1.1.1-0.4.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-logging-jboss	1.1-10.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-modeler	2.0-4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-pool +1	1.3-11.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-validator	1.3.1-7.5.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-oro	2.0.8-3.3.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-taglibs-standard	1.1.1-9.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	javassist	3.12.0-1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-common-core	2.2.17-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-common-logging-jdk +1	2.1.2-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-javaee +3	5.0.1-2.9.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jcommon	1.0.16-1.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jfreechart	1.0.13-2.3.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	log4j	1.2.14-18.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_cluster +5	1.0.10-2.GA_CP01.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_jk +2	1.2.31-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_ssl	1:2.2.17-11.1.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_ssl22	1:2.2.17-14.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mx4j	1:3.0.1-9.3.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	objectweb-asm	3.1-5.3.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	objectweb-asm31	3.1-12.1.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	regexp	1.5-1.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	struts12	1.2.9-3.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat-jkstatus-ant	1.2.31-2.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat-native	1.1.20-2.0.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat5 +12	5.5.33-14_patch_04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat6 +9	6.0.32-14_patch_03.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	xalan-j2	2.7.1-5.3_patch_04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	xerces-j2	2.9.1-3.patch01.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	xml-commons +3	1.3.04-7.10.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	xml-commons-which10 +4	1.3.04-7.14.ep5.el6	RHSA-2011:0897

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.4	7.0.4	GHSA-fj6c-prgj-gr3r
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.30	6.0.30	GHSA-fj6c-prgj-gr3r
Maven	org.apache.tomcat:tomcat	>= 5.5.0, < 5.5.30	5.5.30	GHSA-fj6c-prgj-gr3r

Advisories 4

RHSA-2011:1845 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:0897 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:0791 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DSA-2160-1 tomcat6 - several Debian Security (DSA / DLA) · Mar 9, 2026

References

46177 vdb-entry
oval:org.mitre.oval:def:13969 vdb-entry signature
20110205 [SECURITY] CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions mailing-list
8072 third-party-advisory
http://tomcat.apache.org/security-6.html
HPSBUX02860 vendor-advisory
45022 third-party-advisory
RHSA-2011:1845 vendor-advisory
SUSE-SR:2011:005 vendor-advisory
SSRT100627 vendor-advisory
tomcat-servletcontect-sec-bypass(65159) vdb-entry
APPLE-SA-2011-10-12-3 vendor-advisory
MDVSA-2011:030 vendor-advisory
oval:org.mitre.oval:def:19379 vdb-entry signature
RHSA-2011:0897 vendor-advisory
57126 third-party-advisory
RHSA-2011:0791 vendor-advisory
43192 third-party-advisory
RHSA-2011:0896 vendor-advisory
DSA-2160 vendor-advisory
1025025 vdb-entry
http://support.apple.com/kb/HT5002
http://tomcat.apache.org/security-5.html
oval:org.mitre.oval:def:12517 vdb-entry signature
HPSBUX02645 vendor-advisory
HPSBST02955 vendor-advisory
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://tomcat.apache.org/security-7.html
[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list