VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 27, 2007· Updated Apr 23, 2026

CVE-2007-5342

CVE-2007-5342

Description

Apache Tomcat's default catalina.policy in JULI logging allows web applications to modify logging configuration and overwrite arbitrary files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Tomcat's default catalina.policy in JULI logging allows web applications to modify logging configuration and overwrite arbitrary files.

Vulnerability

The default catalina.policy in the JULI logging component of Apache Tomcat versions 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not properly restrict permissions for web applications [1][2]. This allows attackers to modify logging configuration options, specifically the level, directory, and prefix attributes in the org.apache.juli.FileHandler handler, enabling arbitrary file overwrite [2].

Exploitation

An attacker needs to deploy a malicious web application to the Tomcat server or have existing access to a web application's code execution context. By altering the logging configuration via the JULI handler, the attacker can redirect log output to arbitrary file paths, effectively overwriting any file writable by the Tomcat process [2].

Impact

Successful exploitation allows an attacker to overwrite arbitrary files on the server, potentially leading to denial of service, privilege escalation, or remote code execution if critical files (e.g., configuration or class files) are replaced [2]. The attacker gains the ability to modify system files within the Tomcat process's write permissions.

Mitigation

Apache Tomcat 5.5.26 and 6.0.16 fixed this issue by tightening the default security policy [1][3]. Users should upgrade to these versions or later. Note that Tomcat 5.5.x and 6.0.x have reached end of life and are no longer supported; users are advised to upgrade to a supported branch like 9.0.x [1][3]. No workaround is documented in the available references.

References
  1. Apache Tomcat® - Apache Tomcat 6 vulnerabilities
  2. NVD - CVE-2007-5342
  3. Apache Tomcat® - Apache Tomcat 5 vulnerabilities

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-juliMaven
>= 5.5.9, <= 5.5.25—
org.apache.tomcat:tomcat-juliMaven
>= 6.0.0, <= 6.0.15—

Affected products

34
  • Apache/Tomcat33 versions
    cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*+ 32 more
    • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.tomcat/tomcat-juli
    Range: >= 5.5.9, <= 5.5.25

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

57

News mentions

0

No linked articles in our index yet.