NVD Vulnerability Detail

CVE-2008-2370

Summary	Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Publication Date	Aug. 4, 2008, 10:41 a.m.
Registration Date	Jan. 29, 2021, 1:36 p.m.
Last Update	Feb. 13, 2023, 11:19 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:4.1.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.35:::::::*
cpe:2.3:a:apache:tomcat:4.1.36:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:4.1.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:4.1.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:4.1.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.30:::::::*
cpe:2.3:a:apache:tomcat:4.1.7:::::::*
cpe:2.3:a:apache:tomcat:4.1.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:4.1.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:4.1.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.29:::::::*
cpe:2.3:a:apache:tomcat:4.1.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.13:::::::*
cpe:2.3:a:apache:tomcat:4.1.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:4.1.12:::::::*
cpe:2.3:a:apache:tomcat:4.1.28:::::::*
cpe:2.3:a:apache:tomcat:4.1.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:4.1.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:4.1.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.34:::::::*
cpe:2.3:a:apache:tomcat:4.1.32:::::::*
cpe:2.3:a:apache:tomcat:4.1.37:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*
cpe:2.3:a:apache:tomcat:4.1.9:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://tomcat.apache.org/security-4.html	CONFIRM
2	http://tomcat.apache.org/security-5.html	CONFIRM
3	http://tomcat.apache.org/security-6.html	CONFIRM
4	http://www.securityfocus.com/bid/30494	BID	Exploit Patch
5	http://www.securitytracker.com/id?1020623	SECTRACK
6	http://secunia.com/advisories/31639	SECUNIA
7	http://secunia.com/advisories/31379	SECUNIA
8	http://secunia.com/advisories/31381	SECUNIA
9	http://www.redhat.com/support/errata/RHSA-2008-0648.html	REDHAT
10	http://www.mandriva.com/security/advisories?name=MDVSA-2008:188	MANDRIVA
11	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html	FEDORA
12	http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html	SUSE
13	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html	FEDORA
14	http://secunia.com/advisories/31891	SECUNIA
15	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html	FEDORA
16	http://secunia.com/advisories/31865	SECUNIA
17	http://www.redhat.com/support/errata/RHSA-2008-0862.html	REDHAT
18	http://www.redhat.com/support/errata/RHSA-2008-0864.html	REDHAT
19	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	APPLE
20	http://www.securityfocus.com/bid/31681	BID
21	http://support.apple.com/kb/HT3216	CONFIRM
22	http://secunia.com/advisories/32222	SECUNIA
23	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm	CONFIRM
24	http://securityreason.com/securityalert/4099	SREASON
25	http://secunia.com/advisories/31982	SECUNIA
26	http://marc.info/?l=bugtraq&m=123376588623823&w=2	HP
27	http://secunia.com/advisories/33797	SECUNIA
28	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	SUSE
29	http://secunia.com/advisories/32120	SECUNIA
30	http://secunia.com/advisories/32266	SECUNIA
31	http://www.vmware.com/security/advisories/VMSA-2009-0002.html	CONFIRM
32	http://www.vupen.com/english/advisories/2009/0503	VUPEN
33	http://secunia.com/advisories/33999	SECUNIA
34	http://secunia.com/advisories/34013	SECUNIA
35	http://secunia.com/advisories/35393	SECUNIA
36	http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html	CONFIRM
37	http://www.vupen.com/english/advisories/2009/1535	VUPEN
38	http://www.vupen.com/english/advisories/2009/2215	VUPEN
39	http://secunia.com/advisories/36249	SECUNIA
40	http://secunia.com/advisories/37460	SECUNIA
41	http://www.vupen.com/english/advisories/2009/3316	VUPEN
42	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	CONFIRM
43	http://www.vupen.com/english/advisories/2008/2780	VUPEN
44	http://www.vupen.com/english/advisories/2009/0320	VUPEN
45	http://www.vupen.com/english/advisories/2008/2823	VUPEN
46	http://www.vupen.com/english/advisories/2008/2305	VUPEN
47	http://marc.info/?l=bugtraq&m=139344343412337&w=2	HP
48	http://secunia.com/advisories/57126	SECUNIA
49	https://exchange.xforce.ibmcloud.com/vulnerabilities/44156	XF
50	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5876	OVAL
51	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10577	OVAL
52	http://www.securityfocus.com/archive/1/507985/100/0/threaded	BUGTRAQ
53	http://www.securityfocus.com/archive/1/495022/100/0/threaded	BUGTRAQ
54	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	MISC
55	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	MISC
56	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	MISC
57	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	MISC
58	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	MISC
59	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	MISC
60	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	MISC

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Apache Tomcat の RequestDispatcher に関するディレクトリトラバーサルの脆弱性

Title	Apache Tomcat の RequestDispatcher に関するディレクトリトラバーサルの脆弱性
Summary	Apache Tomcat は RequestDispatcher を使用している場合、URI からのクエリ文字列を削除する前にパスの正常化が動作するため、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	第三者により、任意のファイルを読み取られる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 3, 2008, midnight
Registration Date	Sept. 3, 2008, 3:46 p.m.
Last Update	March 26, 2015, 5:43 p.m.

Affected System

サン・マイクロシステムズ

OpenSolaris (sparc)

OpenSolaris (x86)

Sun Solaris 10 (sparc)

Sun Solaris 10 (x86)

Sun Solaris 9 (sparc)

Sun Solaris 9 (x86)

レッドハット

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

ヒューレット・パッカード

HP XP P9000 Performance Advisor ソフトウェア 5.4.1 未満

Apache Software Foundation

Apache Tomcat 4.1.0 から 4.1.37 のバージョン

Apache Tomcat 5.5.0 から 5.5.26 のバージョン

Apache Tomcat 6.0.0 から 6.0.16 のバージョン

サイバートラスト株式会社

Asianux Server 2.0

Asianux Server 2.1

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

アップル

Apple Mac OS X Server v10.5.5

日本電気

WebOTX Application Server

富士通

Interstage Application Framework Suite

Interstage Application Server

Interstage Apworks

Interstage Business Application Server

Interstage Job Workload Server

Interstage Studio

Interstage Web Server

VMware

VMware ESX 3.0.3

VMware ESX 3.5

VMware ESX 4.0

VMware Server 2.x

VMware vCenter 4.0

VMware VirtualCenter 2.0.2

VMware VirtualCenter 2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-2370	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370
National Vulnerability Database (NVD)
2	CVE-2008-2370	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2370

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Apache Tomcat
1	Fixed in Apache Tomcat 4.1.SVN	http://tomcat.apache.org/security-4.html
2	Fixed in Apache Tomcat 5.5.SVN	http://tomcat.apache.org/security-5.html
3	Fixed in Apache Tomcat 6.0.18	http://tomcat.apache.org/security-6.html
Apple Mailing Lists
4	APPLE-SA-2008-10-09 Security Update 2008-007	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
Apple Security Updates
5	HT3216	http://support.apple.com/en-us/HT3216
Apple セキュリティアップデート
6	HT3216	http://support.apple.com/ja-jp/HT3216
Asianux Technical Support Network
7	tomcat5-5.5.23-0jpp.7.1.1AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=156
Avaya Support
8	ASA-2008-401	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
HP Security Bulletin
9	HPSBST02955 SSRT101157	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04047415
10	HPSBUX02401 SSRT090005	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01650939
MIRACLE LINUX アップデート情報
11	1381	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1381
NEC製品セキュリティ情報
12	NV09-012	http://www.nec.co.jp/security-info/secinfo/nv09-012.html
Red Hat Security Advisory
13	RHSA-2008:0648	https://rhn.redhat.com/errata/RHSA-2008-0648.html
14	RHSA-2008:0862	https://rhn.redhat.com/errata/RHSA-2008-0862.html
SECURITY BLOG
15	Multiple vulnerabilities in Oracle Java Web Console	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_oracle_java1
Sun Alert Notification
16	251986	http://sunsolve.sun.com/search/document.do?assetkey=1-66-251986-1
VMware Security Advisories
17	VMSA-2009-0002	http://www.vmware.com/security/advisories/VMSA-2009-0002.html
18	VMSA-2009-0016	http://www.vmware.com/security/advisories/VMSA-2009-0016.html
富士通セキュリティ情報
19	interstage_as_200902	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_as_200902.html

その他

No	Name	URL
FrSIRT Advisories
1	FrSIRT/ADV-2008-2305	http://www.frsirt.com/english/advisories/2008/2305
ISS X-Force Database
2	44156	http://xforce.iss.net/xforce/xfdb/44156
Secunia Advisory
3	SA31379	http://secunia.com/advisories/31379
4	SA31381	http://secunia.com/advisories/31381
SecurityFocus
5	30494	http://www.securityfocus.com/bid/30494
SecurityTracker
6	1020623	http://www.securitytracker.com/id?1020623

Change Log

No	Changed Details	Date of change
0	[2008年09月03日] 掲載 [2008年10月27日] 影響を受けるシステム：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）の情報を追加ベンダ情報：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）を追加 [2008年11月04日] 影響を受けるシステム：アップル（HT3216）の情報を追加ベンダ情報：アップル（HT3216）を追加 [2009年02月12日] 影響を受けるシステム：ヒューレット・パッカード (HPSBUX02401) の情報を追加影響を受けるシステム：ミラクル・リナックス (1381) の情報を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02401 SSRT090005) を追加ベンダ情報：ミラクル・リナックス (1381) を追加 [2009年07月08日] 影響を受けるシステム：富士通 (interstage_as_200902) の情報を追加ベンダ情報：富士通 (interstage_as_200902) を追加 [2009年10月20日] 影響を受けるシステム：日本電気 (NV09-012) の情報を追加ベンダ情報：日本電気 (NV09-012) を追加 [2010年01月05日] 影響を受けるシステム：VMware (VMSA-2009-0016) の情報を追加ベンダ情報：VMware (VMSA-2009-0016) を追加 [2012年09月28日] ベンダ情報：オラクル (Multiple vulnerabilities in Oracle Java Web Console) を追加 [2015年03月26日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBST02955 SSRT101157) を追加ベンダ情報：VMware（VMSA-2009-0002）を追加ベンダ情報：レッドハット（RHSA-2008:0862）を追加ベンダ情報：アバイア（ASA-2008-401）を追加ベンダ情報：アップル（APPLE-SA-2008-10-09 Security Update 2008-007) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:4.1.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.35:::::::*
cpe:2.3:a:apache:tomcat:4.1.36:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:4.1.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:4.1.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:4.1.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.30:::::::*
cpe:2.3:a:apache:tomcat:4.1.7:::::::*
cpe:2.3:a:apache:tomcat:4.1.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:4.1.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:4.1.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.29:::::::*
cpe:2.3:a:apache:tomcat:4.1.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.13:::::::*
cpe:2.3:a:apache:tomcat:4.1.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:4.1.12:::::::*
cpe:2.3:a:apache:tomcat:4.1.28:::::::*
cpe:2.3:a:apache:tomcat:4.1.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:4.1.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:4.1.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.34:::::::*
cpe:2.3:a:apache:tomcat:4.1.32:::::::*
cpe:2.3:a:apache:tomcat:4.1.37:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*
cpe:2.3:a:apache:tomcat:4.1.9:::::::*