CVE-2008-2938
NoneCVSS
—
EPSS
99.7%
Published
Aug 13, 2008
CISA due date
—
The record
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 4.1.0 | 4.1.39 |
| Maven | org.apache.tomcat:tomcat | 5.5.0 | 5.5.27 |
| Maven | org.apache.tomcat:tomcat | 6.0.0 | 6.0.18 |
| Red Hat:enterprise_linux:5::client | tomcat5 | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client | tomcat5-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5 | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5 | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:enterprise_linux:5::server | tomcat5-webapps | 0 | 0:5.5.23-0jpp.7.el5_2.1 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el4 | jbossweb | 0 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.2.0::el5 | jbossweb | 0 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el4 | jbossweb | 0 | 0:2.0.0-5.CP07.0jpp.ep1.1.el4 |
| Red Hat:jboss_enterprise_application_platform:4.3.0::el5 | jbossweb | 0 | 0:2.0.0-5.CP07.0jpp.ep1.1.el5 |
| Red Hat:network_satellite:5.0:el4 | tomcat5 | 0 | 0:5.0.30-0jpp_12rh |
| Red Hat:network_satellite:5.1::el4 | tomcat5 | 0 | 0:5.0.30-0jpp_12rh |
| Red Hat:rhel_application_server:2 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_application_server:2 | tomcat5-webapps | 0 | 0:5.5.23-0jpp_4rh.9 |
| Red Hat:rhel_developer_suite:3 | tomcat5 | 0 | 0:5.5.23-0jpp_12rh |
| Red Hat:rhel_developer_suite:3 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_12rh |
| Red Hat:rhel_developer_suite:3 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_12rh |
| Red Hat:rhel_developer_suite:3 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_12rh |
| Red Hat:rhel_developer_suite:3 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_12rh |
| Red Hat:rhel_developer_suite:3 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_12rh |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat