CVE-2009-0783 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Local users can read or modify configuration files of other web applications by replacing the shared XML parser in Apache Tomcat.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0783?
CVE-2009-0783 is a medium-severity vulnerability in Apache Tomcat, published on 5 Jun 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Weakness: CWE-200
Which versions are affected by CVE-2009-0783?
6 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 4.1.0 to 4.1.39 | None |
org.apache.tomcat:tomcat Maven | From 4.1.0 to 4.1.39 | None |
org.apache.tomcat:tomcat Maven | From 5.5.0 to 5.5.27 | None |
org.apache.tomcat:tomcat Maven | From 5.5.0 to 5.5.27 | None |
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.20 |
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.20 |
Products include Apache Tomcat.
How do I fix CVE-2009-0783?
Upgrade org.apache.tomcat:tomcat to 6.0.20 or later.
Is CVE-2009-0783 being exploited?
There is no known exploitation of CVE-2009-0783 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-hhjg-g8xq-hhr3.