PT-2014-2453 · Apache · Apache Tomcat

Agostino Sarubbo + 1 · Published 2014-02-15 · Updated 2024-08-06 · CVE-2013-0346

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.x

Description The issue allows local users to potentially obtain sensitive information by reading files due to world-readable permissions for the log directory and its files. However, one Tomcat distributor claims that the log directory does not contain sensitive information.

Recommendations For Apache Tomcat version 7.x, consider changing the permissions of the log directory and its files to prevent world-readable access, thereby minimizing the risk of sensitive information disclosure.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-0346

Affected Products

Apache Tomcat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-0346 · Security Note
• http://openwall.com/lists/oss-security/2013/02/23/5 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0346 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=924841 · Note
• https://t.me/cvenotify/89443 · Telegram Post