CVSS 3.0
4.2 mediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LCVE-2009-0783
Medium (4.2) in apache tomcat. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 6.0.20.
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hhjg-g8xq-hhr3 | Maven | org.apache.tomcat:tomcat | >=4.1.0 <=4.1.39 | no fix published |
| GHSA-hhjg-g8xq-hhr3 | Maven | org.apache.tomcat:tomcat | >=5.5.0 <=5.5.27 | no fix published |
| GHSA-hhjg-g8xq-hhr3 | Maven | org.apache.tomcat:tomcat | >=6.0.0 <6.0.20 | 6.0.20 |