CVE-2007-5342

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-12-27 · updated 2026-06-16
Weakness: CWE-264

Description

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.

Affected products

Apache Tomcat: 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14 (+27)

References

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://osvdb.org/39833
http://secunia.com/advisories/28274
http://secunia.com/advisories/28317
http://secunia.com/advisories/28915
http://secunia.com/advisories/29313
http://secunia.com/advisories/29711
http://secunia.com/advisories/30676
http://secunia.com/advisories/32120
http://secunia.com/advisories/32222

Get alerted when CVE-2007-5342 or the next vulnerability affects your stack