GitHub Advisoryadvisory · Maven

GHSA-qrcx-p4rr-g48h Apache Tomcat allows remote attackers to read JSP source files

HIGH Published 2022-05-01 Modified 2023-09-18 Official page ↗
Aliases
CVE-2005-4836
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
Weaknesses
CWE-200
Reviewed
2023-09-18

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.1.15, <= 4.1.40 (no fix yet)

Description

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

Related

Alias · CVE (1)

  • CVE-2005-4836 The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References