NVD脆弱性詳細

CVE-2008-2370

概要	Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
公表日	2008年8月4日10:41
登録日	2021年1月29日13:36
最終更新日	2023年2月13日11:19

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:4.1.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.35:::::::*
cpe:2.3:a:apache:tomcat:4.1.36:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:4.1.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:4.1.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:4.1.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.30:::::::*
cpe:2.3:a:apache:tomcat:4.1.7:::::::*
cpe:2.3:a:apache:tomcat:4.1.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:4.1.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:4.1.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.29:::::::*
cpe:2.3:a:apache:tomcat:4.1.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.13:::::::*
cpe:2.3:a:apache:tomcat:4.1.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:4.1.12:::::::*
cpe:2.3:a:apache:tomcat:4.1.28:::::::*
cpe:2.3:a:apache:tomcat:4.1.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:4.1.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:4.1.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.34:::::::*
cpe:2.3:a:apache:tomcat:4.1.32:::::::*
cpe:2.3:a:apache:tomcat:4.1.37:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*
cpe:2.3:a:apache:tomcat:4.1.9:::::::*

関連情報、対策とツール

No	URL	refsource	タグ
1	http://tomcat.apache.org/security-4.html	CONFIRM
2	http://tomcat.apache.org/security-5.html	CONFIRM
3	http://tomcat.apache.org/security-6.html	CONFIRM
4	http://www.securityfocus.com/bid/30494	BID	Exploit Patch
5	http://www.securitytracker.com/id?1020623	SECTRACK
6	http://secunia.com/advisories/31639	SECUNIA
7	http://secunia.com/advisories/31379	SECUNIA
8	http://secunia.com/advisories/31381	SECUNIA
9	http://www.redhat.com/support/errata/RHSA-2008-0648.html	REDHAT
10	http://www.mandriva.com/security/advisories?name=MDVSA-2008:188	MANDRIVA
11	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html	FEDORA
12	http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html	SUSE
13	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html	FEDORA
14	http://secunia.com/advisories/31891	SECUNIA
15	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html	FEDORA
16	http://secunia.com/advisories/31865	SECUNIA
17	http://www.redhat.com/support/errata/RHSA-2008-0862.html	REDHAT
18	http://www.redhat.com/support/errata/RHSA-2008-0864.html	REDHAT
19	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	APPLE
20	http://www.securityfocus.com/bid/31681	BID
21	http://support.apple.com/kb/HT3216	CONFIRM
22	http://secunia.com/advisories/32222	SECUNIA
23	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm	CONFIRM
24	http://securityreason.com/securityalert/4099	SREASON
25	http://secunia.com/advisories/31982	SECUNIA
26	http://marc.info/?l=bugtraq&m=123376588623823&w=2	HP
27	http://secunia.com/advisories/33797	SECUNIA
28	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	SUSE
29	http://secunia.com/advisories/32120	SECUNIA
30	http://secunia.com/advisories/32266	SECUNIA
31	http://www.vmware.com/security/advisories/VMSA-2009-0002.html	CONFIRM
32	http://www.vupen.com/english/advisories/2009/0503	VUPEN
33	http://secunia.com/advisories/33999	SECUNIA
34	http://secunia.com/advisories/34013	SECUNIA
35	http://secunia.com/advisories/35393	SECUNIA
36	http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html	CONFIRM
37	http://www.vupen.com/english/advisories/2009/1535	VUPEN
38	http://www.vupen.com/english/advisories/2009/2215	VUPEN
39	http://secunia.com/advisories/36249	SECUNIA
40	http://secunia.com/advisories/37460	SECUNIA
41	http://www.vupen.com/english/advisories/2009/3316	VUPEN
42	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	CONFIRM
43	http://www.vupen.com/english/advisories/2008/2780	VUPEN
44	http://www.vupen.com/english/advisories/2009/0320	VUPEN
45	http://www.vupen.com/english/advisories/2008/2823	VUPEN
46	http://www.vupen.com/english/advisories/2008/2305	VUPEN
47	http://marc.info/?l=bugtraq&m=139344343412337&w=2	HP
48	http://secunia.com/advisories/57126	SECUNIA
49	https://exchange.xforce.ibmcloud.com/vulnerabilities/44156	XF
50	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5876	OVAL
51	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10577	OVAL
52	http://www.securityfocus.com/archive/1/507985/100/0/threaded	BUGTRAQ
53	http://www.securityfocus.com/archive/1/495022/100/0/threaded	BUGTRAQ
54	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	MISC
55	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	MISC
56	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	MISC
57	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	MISC
58	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	MISC
59	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	MISC
60	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	MISC

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN脆弱性情報

Apache Tomcat の RequestDispatcher に関するディレクトリトラバーサルの脆弱性

タイトル	Apache Tomcat の RequestDispatcher に関するディレクトリトラバーサルの脆弱性
概要	Apache Tomcat は RequestDispatcher を使用している場合、URI からのクエリ文字列を削除する前にパスの正常化が動作するため、ディレクトリトラバーサルの脆弱性が存在します。
想定される影響	第三者により、任意のファイルを読み取られる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2008年8月3日0:00
登録日	2008年9月3日15:46
最終更新日	2015年3月26日17:43

影響を受けるシステム

サン・マイクロシステムズ

OpenSolaris (sparc)

OpenSolaris (x86)

Sun Solaris 10 (sparc)

Sun Solaris 10 (x86)

Sun Solaris 9 (sparc)

Sun Solaris 9 (x86)

レッドハット

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

ヒューレット・パッカード

HP XP P9000 Performance Advisor ソフトウェア 5.4.1 未満

Apache Software Foundation

Apache Tomcat 4.1.0 から 4.1.37 のバージョン

Apache Tomcat 5.5.0 から 5.5.26 のバージョン

Apache Tomcat 6.0.0 から 6.0.16 のバージョン

サイバートラスト株式会社

Asianux Server 2.0

Asianux Server 2.1

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

アップル

Apple Mac OS X Server v10.5.5

日本電気

WebOTX Application Server

富士通

Interstage Application Framework Suite

Interstage Application Server

Interstage Apworks

Interstage Business Application Server

Interstage Job Workload Server

Interstage Studio

Interstage Web Server

VMware

VMware ESX 3.0.3

VMware ESX 3.5

VMware ESX 4.0

VMware Server 2.x

VMware vCenter 4.0

VMware VirtualCenter 2.0.2

VMware VirtualCenter 2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-2370	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370
National Vulnerability Database (NVD)
2	CVE-2008-2370	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2370

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	名前	URL
Apache Tomcat
1	Fixed in Apache Tomcat 4.1.SVN	http://tomcat.apache.org/security-4.html
2	Fixed in Apache Tomcat 5.5.SVN	http://tomcat.apache.org/security-5.html
3	Fixed in Apache Tomcat 6.0.18	http://tomcat.apache.org/security-6.html
Apple Mailing Lists
4	APPLE-SA-2008-10-09 Security Update 2008-007	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
Apple Security Updates
5	HT3216	http://support.apple.com/en-us/HT3216
Apple セキュリティアップデート
6	HT3216	http://support.apple.com/ja-jp/HT3216
Asianux Technical Support Network
7	tomcat5-5.5.23-0jpp.7.1.1AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=156
Avaya Support
8	ASA-2008-401	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
HP Security Bulletin
9	HPSBST02955 SSRT101157	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04047415
10	HPSBUX02401 SSRT090005	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01650939
MIRACLE LINUX アップデート情報
11	1381	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1381
NEC製品セキュリティ情報
12	NV09-012	http://www.nec.co.jp/security-info/secinfo/nv09-012.html
Red Hat Security Advisory
13	RHSA-2008:0648	https://rhn.redhat.com/errata/RHSA-2008-0648.html
14	RHSA-2008:0862	https://rhn.redhat.com/errata/RHSA-2008-0862.html
SECURITY BLOG
15	Multiple vulnerabilities in Oracle Java Web Console	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_oracle_java1
Sun Alert Notification
16	251986	http://sunsolve.sun.com/search/document.do?assetkey=1-66-251986-1
VMware Security Advisories
17	VMSA-2009-0002	http://www.vmware.com/security/advisories/VMSA-2009-0002.html
18	VMSA-2009-0016	http://www.vmware.com/security/advisories/VMSA-2009-0016.html
富士通セキュリティ情報
19	interstage_as_200902	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_as_200902.html

その他

No	名前	URL
FrSIRT Advisories
1	FrSIRT/ADV-2008-2305	http://www.frsirt.com/english/advisories/2008/2305
ISS X-Force Database
2	44156	http://xforce.iss.net/xforce/xfdb/44156
Secunia Advisory
3	SA31379	http://secunia.com/advisories/31379
4	SA31381	http://secunia.com/advisories/31381
SecurityFocus
5	30494	http://www.securityfocus.com/bid/30494
SecurityTracker
6	1020623	http://www.securitytracker.com/id?1020623

変更履歴

No	変更内容	変更日
0	[2008年09月03日] 掲載 [2008年10月27日] 影響を受けるシステム：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）の情報を追加ベンダ情報：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）を追加 [2008年11月04日] 影響を受けるシステム：アップル（HT3216）の情報を追加ベンダ情報：アップル（HT3216）を追加 [2009年02月12日] 影響を受けるシステム：ヒューレット・パッカード (HPSBUX02401) の情報を追加影響を受けるシステム：ミラクル・リナックス (1381) の情報を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02401 SSRT090005) を追加ベンダ情報：ミラクル・リナックス (1381) を追加 [2009年07月08日] 影響を受けるシステム：富士通 (interstage_as_200902) の情報を追加ベンダ情報：富士通 (interstage_as_200902) を追加 [2009年10月20日] 影響を受けるシステム：日本電気 (NV09-012) の情報を追加ベンダ情報：日本電気 (NV09-012) を追加 [2010年01月05日] 影響を受けるシステム：VMware (VMSA-2009-0016) の情報を追加ベンダ情報：VMware (VMSA-2009-0016) を追加 [2012年09月28日] ベンダ情報：オラクル (Multiple vulnerabilities in Oracle Java Web Console) を追加 [2015年03月26日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBST02955 SSRT101157) を追加ベンダ情報：VMware（VMSA-2009-0002）を追加ベンダ情報：レッドハット（RHSA-2008:0862）を追加ベンダ情報：アバイア（ASA-2008-401）を追加ベンダ情報：アップル（APPLE-SA-2008-10-09 Security Update 2008-007) を追加	2018年2月17日10:37

構成1	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:4.1.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.35:::::::*
cpe:2.3:a:apache:tomcat:4.1.36:::::::*
cpe:2.3:a:apache:tomcat:5.5.18:::::::*
cpe:2.3:a:apache:tomcat:4.1.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.14:::::::*
cpe:2.3:a:apache:tomcat:4.1.24:::::::*
cpe:2.3:a:apache:tomcat:5.5.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.7:::::::*
cpe:2.3:a:apache:tomcat:5.5.11:::::::*
cpe:2.3:a:apache:tomcat:4.1.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.6:::::::*
cpe:2.3:a:apache:tomcat:5.5.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.4:::::::*
cpe:2.3:a:apache:tomcat:5.5.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.15:::::::*
cpe:2.3:a:apache:tomcat:5.5.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.27:::::::*
cpe:2.3:a:apache:tomcat:6.0.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.30:::::::*
cpe:2.3:a:apache:tomcat:4.1.7:::::::*
cpe:2.3:a:apache:tomcat:4.1.11:::::::*
cpe:2.3:a:apache:tomcat:5.5.21:::::::*
cpe:2.3:a:apache:tomcat:4.1.18:::::::*
cpe:2.3:a:apache:tomcat:5.5.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:6.0.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.19:::::::*
cpe:2.3:a:apache:tomcat:6.0.9:::::::*
cpe:2.3:a:apache:tomcat:4.1.31:::::::*
cpe:2.3:a:apache:tomcat:5.5.3:::::::*
cpe:2.3:a:apache:tomcat:4.1.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.29:::::::*
cpe:2.3:a:apache:tomcat:4.1.22:::::::*
cpe:2.3:a:apache:tomcat:4.1.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.26:::::::*
cpe:2.3:a:apache:tomcat:4.1.13:::::::*
cpe:2.3:a:apache:tomcat:4.1.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.9:::::::*
cpe:2.3:a:apache:tomcat:5.5.25:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.17:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:5.5.2:::::::*
cpe:2.3:a:apache:tomcat:4.1.33:::::::*
cpe:2.3:a:apache:tomcat:5.5.0:::::::*
cpe:2.3:a:apache:tomcat:4.1.1:::::::*
cpe:2.3:a:apache:tomcat:5.5.13:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:6.0.12:::::::*
cpe:2.3:a:apache:tomcat:5.5.24:::::::*
cpe:2.3:a:apache:tomcat:4.1.12:::::::*
cpe:2.3:a:apache:tomcat:4.1.28:::::::*
cpe:2.3:a:apache:tomcat:4.1.15:::::::*
cpe:2.3:a:apache:tomcat:4.1.10:::::::*
cpe:2.3:a:apache:tomcat:5.5.8:::::::*
cpe:2.3:a:apache:tomcat:5.5.16:::::::*
cpe:2.3:a:apache:tomcat:4.1.0:::::::*
cpe:2.3:a:apache:tomcat:6.0.5:::::::*
cpe:2.3:a:apache:tomcat:4.1.20:::::::*
cpe:2.3:a:apache:tomcat:5.5.17:::::::*
cpe:2.3:a:apache:tomcat:4.1.3:::::::*
cpe:2.3:a:apache:tomcat:5.5.19:::::::*
cpe:2.3:a:apache:tomcat:4.1.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.34:::::::*
cpe:2.3:a:apache:tomcat:4.1.32:::::::*
cpe:2.3:a:apache:tomcat:4.1.37:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:5.5.23:::::::*
cpe:2.3:a:apache:tomcat:4.1.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.8:::::::*
cpe:2.3:a:apache:tomcat:4.1.9:::::::*