CVE-2013-0346

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-15 · updated 2026-06-16
Weakness: CWE-264

Description

Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

Affected products

Apache Tomcat: 7.0.0, 7.0.0-beta, 7.0.1, 7.0.2, 7.0.2-beta, 7.0.3 (+48)

References

http://www.openwall.com/lists/oss-security/2013/02/23/5
https://bugzilla.redhat.com/show_bug.cgi?id=924841
http://www.openwall.com/lists/oss-security/2013/02/23/5
https://bugzilla.redhat.com/show_bug.cgi?id=924841

Get alerted when CVE-2013-0346 or the next vulnerability affects your stack