NetSight
IP …
low1.2

CVE-2010-3718

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows …

Impact

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

Affected products

VendorProductAffected versions
ApacheTomcat
Versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 6.0, 6.0.0

References