• This alert was generated using only banner information. It may be a false positive.
  
  Fixed in Apache Tomcat 6.0.10:
  
  • important: Directory traversal CVE-2007-0450
    Tomcat permits '\', '%2F' and '%5C' as path delimiters. When Tomcat is used behind a proxy (including, but not limited to, Apache HTTP server with mod_proxy and mod_jk) configured to only proxy some contexts, a HTTP request containing strings like "/\../" may allow attackers to work around the context restriction of the proxy, and access the non-proxied contexts.
    
    The following Java system properties have been added to Tomcat to provide additional control of the handling of path delimiters in URLs (both options default to false):
    
    * org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH: true|false
    * org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH: true|false
    
    Due to the impossibility to guarantee that all URLs are handled by Tomcat as they are in proxy servers, Tomcat should always be secured as if no proxy restricting context access was used.
  
  Affected Apache Tomcat version (6.0.0 - 6.0.9).
  

• Upgrade Apache Tomcat to the latest version.

• • Apache Tomcat 6.x vulnerabilities

• 

• CVE-2007-0450

• CWE-22

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Directory Traversal Missing Update

• WordPress Plugin Xtreme Locator Dealer Locator SQL Injection (1.5)
• WordPress Plugin Visual Composer:Page Builder for WordPress Local File Inclusion (5.1)
• WordPress Plugin CevherShare 'cevhershare-admin.php' SQL Injection (2.0)
• WordPress Plugin Stream Video Player Cross-Site Request Forgery (1.4.0)
• WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (12.0.1)