VYPR
← All advisories
Medium severity4.2NVD Advisory· Published Jun 5, 2009· Updated Apr 23, 2026

CVE-2009-0783

CVE-2009-0783

Description

Apache Tomcat allows a malicious web application to replace the XML parser, enabling reading or modification of configuration files of other applications.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Tomcat allows a malicious web application to replace the XML parser, enabling reading or modification of configuration files of other applications.

Vulnerability

Apache Tomcat versions 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 contain a vulnerability where a web application can replace the XML parser used by other web applications [1][3][4]. This allows a crafted application loaded earlier to affect the parsing of XML configuration files (web.xml, context.xml, tld files) of other applications.

Exploitation

An attacker must have the ability to deploy a malicious web application to the Tomcat server (local user with deploy permissions). The crafted application must be loaded before the target application. By replacing the XML parser, the attacker can intercept or modify the parsing of configuration files of other applications.

Impact

Successful exploitation allows the attacker to read or modify the web.xml, context.xml, or tld files of arbitrary web applications. This could lead to disclosure of sensitive configuration data or alteration of application behavior, potentially resulting in privilege escalation or further compromise.

Mitigation

Tomcat 6.0.x has reached end of life and no fix will be provided [1]. Tomcat 5.x is also end of life [4]. Users should upgrade to Tomcat 9.0.x or later. For affected versions, no patch is available; the only mitigation is to restrict deployment of untrusted applications. Apple included a fix in Security Update 2010-002 for Mac OS X [2].

References
  1. Apache Tomcat® - Apache Tomcat 6 vulnerabilities
  2. About the security content of Security Update 2010-002 / Mac OS X v10.6.3 - Apple Support
  3. NVD - CVE-2009-0783
  4. Apache Tomcat® - Apache Tomcat 5 vulnerabilities

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcatMaven
>= 4.1.0, <= 4.1.39—
org.apache.tomcat:tomcatMaven
>= 5.5.0, <= 5.5.27—
org.apache.tomcat:tomcatMaven
>= 6.0.0, < 6.0.206.0.20

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

56

News mentions

0

No linked articles in our index yet.