KLA10070 RLF vulnerability in Apache Tomcat

An improper class constriction vulnerability was found in Apache Tomcat. By exploiting this vulnerability malicious users can read arbitrary files. This vulnerability can be exploited from the network at a point related to the XML parser via a specially designed web application.

Original advisories

Apache changelog

Related products

Apache-Tomcat

CVE list

CVE-2014-0119 warning

Solution

Update to latest version

Impacts

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Apache Tomcat versions 6.0.40 and earlierApache Tomcat 7 versions 7.0.53 and earlierApache Tomcat 8 versions 8.0.5 and earlier