Description

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

Remediation

References

CVE-2009-0783

Related Vulnerabilities

WordPress Plugin Flash Photo Gallery Cross-Site Scripting (0.7)

WordPress Plugin Sign-up Sheets Cross-Site Scripting (1.0.13)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3827)

MediaWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-41800)

Undertow Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2023-1108)

Severity

Medium

Classification

CVE-2009-0783 CWE-200 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities