~ / search / GHSA-wfj7-mhr5-pcwq

GHSA-wfj7-mhr5-pcwq

Apache Tomcat Reveals Directories

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-3835

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat >= 5.0.0, < 5.5.17 5.5.17

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (`;`) preceding a filename with a mapped extension, as demonstrated by URLs ending with `/;index.jsp` and `/;help.do`.

References

External links from the advisory. They lead to third-party sites.