{"id":"CVE-2008-0002","published":"2008-02-12T00:00:00Z","modified":"2024-08-07T07:32:23Z","title":"Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05016,"percentile":0.92222,"provenance":"source"},"cwes":[],"references":[{"url":"http://securityreason.com/securityalert/3638","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://www.securityfocus.com/bid/27703","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://secunia.com/advisories/28915","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/37460","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/487812/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securityfocus.com/bid/31681","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://secunia.com/advisories/28834","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2008/0488","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securityfocus.com/archive/1/507985/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/57126","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/32222","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://security.gentoo.org/glsa/glsa-200804-10.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2008/2780","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://support.apple.com/kb/HT3216","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/29711","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2009/3316","tags":["vdb-entry","x_refsource_VUPEN"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.44}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=6.0.0, <6.0.16"],"patched":["6.0.16"],"from":["GHSA-5x5f-9r6q-q7mh"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2675","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2007-0450","published":"2007-03-16","fixed":"6.0.10","kev":false},{"cve":"CVE-2007-2450","published":"2007-06-14","fixed":"6.0.14","kev":false},{"cve":"CVE-2007-5333","published":"2008-02-12","fixed":"6.0.15","kev":false,"link":{"from":"CVE-2007-5333","to":"CVE-2008-0002","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.15","toFixed":"6.0.16","daysApart":0}]}},{"cve":"CVE-2008-0002","published":"2008-02-12","fixed":"6.0.16","kev":false},{"cve":"CVE-2008-1232","published":"2008-08-04","fixed":"6.0.17","kev":false,"link":{"from":"CVE-2008-0002","to":"CVE-2008-1232","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.16","toFixed":"6.0.17","daysApart":174}]}},{"cve":"CVE-2008-1947","published":"2008-06-04","fixed":"6.0.18","kev":false},{"cve":"CVE-2008-2370","published":"2008-08-04","fixed":"6.0.18","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}