CVE-2013-4444
Published Sep 12, 2014
Last updated 4 years ago
Overview
- Description
- Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
- Source
- secalert@redhat.com
- NVD status
- Modified
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-94
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEBF404D-B53C-4B16-9010-0777DEE1B9E8",
"versionEndIncluding": "7.0.39"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F8C62EF-1B67-456A-9C66-755439CF8556"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33E9607B-4D28-460D-896B-E4B7FA22441E"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A819E245-D641-4F19-9139-6C940504F6E7"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C381275-10C5-4939-BCE3-0D1F3B3CB2EE"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81A31CA0-A209-4C49-AA06-C38E165E5B68"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7205475A-6D04-4042-B24E-1DA5A57029B7"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08022987-B36B-4F63-88A5-A8F59195DF4A"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AA563BF-A67A-477D-956A-167ABEF885C5"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9731BAA-4C6C-4259-B786-F577D8A90FA1"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F74A421-D019-4248-84B8-C70D4D9A8A95"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05346F5A-FB52-4376-AAC7-9A5308216545"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "305688F2-50A6-41FB-8614-BC589DB9A789"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D24AA431-C436-4AA5-85DF-B9AAFF2548FC"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25966344-15D5-4101-9346-B06BFD2DFFF5"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11F4CBAC-27B1-4EFF-955A-A63B457D0578"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD55B338-9DBE-4643-ABED-A08964D3AF7C"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D4F710E-06EA-48F4-AC6A-6F143950F015"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C4936C2-0B2D-4C44-98C3-443090965F5E"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "48453405-2319-4327-9F4C-6F70B49452C6"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49DD9544-6424-41A6-AEC0-EC19B8A10E71"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4670E65-2E11-49A4-B661-57C2F60D411F"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E8FF71D-4710-4FBB-9925-A6A26C450F7D"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31002A23-4788-4BC7-AE11-A3C2AA31716D"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7144EDDF-8265-4642-8EEB-ED52527E0A26"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF06B5C1-B9DD-4673-A101-56E1E593ACDD"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D731065-626B-4425-8E49-F708DD457824"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3D850EA-E537-42C8-93B9-96E15CB26747"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E037DA05-2BEF-4F64-B8BB-307247B6A05C"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BCAF1EB5-FB34-40FC-96ED-9D073890D8BF"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D395D95B-1F4A-420E-A0F6-609360AF7B69"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BD221BA-0AB6-4972-8AD9-5D37AC07762F"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E55B6565-96CB-4F6A-9A80-C3FB82F30546"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3300AFE-49A4-4904-B9A0-5679F09FA01E"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED5125CC-05F9-4678-90DB-A5C7CD24AE6F"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8"
},
{
"criteria": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B904C74-B92E-4EAE-AE6C-78E2B844C3DB"
}
],
"operator": "OR"
}
]
}
]