CVE-2008-2370: Apache Tomcat RequestDispatcher path traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated file read with a high EPSS percentile, though limited to confidentiality impact and no confirmed in-the-wild exploitation.

What it is

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 normalize the request path before stripping the query string when a RequestDispatcher is used. This ordering flaw lets a crafted .. sequence in a request parameter escape the intended path and read arbitrary files. It matters because the affected versions were widely deployed and the flaw is remotely reachable without authentication.

Impact

An unauthenticated remote attacker can read files outside the intended web path, potentially exposing configuration, credentials or source code. The CVSS 2.0 vector shows partial confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network via HTTP requests that trigger RequestDispatcher handling with a crafted parameter containing .. sequences. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS 30-day probability is 0.52716 (percentile 0.98915), indicating elevated predicted exploitation activity, though the reference list carries no exploit tags.

What to do

• Upgrade Tomcat to a release after 4.1.37, 5.5.26 or 6.0.16, or to a currently supported branch.
• If immediate upgrade is not possible, apply the vendor fix referenced in the Apache Tomcat security pages for the affected branches.
• Restrict network access to Tomcat connectors and place them behind a reverse proxy that rejects encoded or dot-dot path segments.
• Run Tomcat with least privilege so file reads are limited to non-sensitive paths.
• Audit RequestDispatcher usage in deployed applications for untrusted parameter input.

Detection

• Monitor web logs for requests containing .. or encoded dot-dot sequences in parameters handled by RequestDispatcher.
• Alert on HTTP responses returning files outside the web application root, such as configuration or system files.
• Review Tomcat access logs for anomalous file path patterns from single source IPs.
• Check deployed Tomcat versions against the affected ranges 4.1.0-4.1.37, 5.5.0-5.5.26 and 6.0.0-6.0.16.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.