CVE-2008-2938

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.0 through 4.1.37 Apache Tomcat versions 5.5.0 through 5.5.26 Apache Tomcat versions 6.0.0 through 6.0.16

Description The issue allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI when allowLinking and UTF-8 are enabled.

Recommendations For versions 4.1.0 through 4.1.37, consider disabling the allowLinking feature to prevent exploitation. For versions 5.5.0 through 5.5.26, restrict access to sensitive files and directories to minimize the risk of arbitrary file reading. For versions 6.0.0 through 6.0.16, avoid using UTF-8 encoding in the URI to prevent directory traversal attacks.