GitHub Advisoryadvisory · Maven

GHSA-wfj7-mhr5-pcwq Apache Tomcat Reveals Directories

MEDIUM Published 2022-05-01 Modified 2025-04-04 Official page ↗
Aliases
CVE-2006-3835
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2025-04-04

Affected packages

• Maven org.apache.tomcat:tomcat: >= 5.0.0, < 5.5.17 → fixed in 5.5.17

Description

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (`;`) preceding a filename with a mapped extension, as demonstrated by URLs ending with `/;index.jsp` and `/;help.do`.

Related

Alias · CVE (1)

  • CVE-2006-3835 Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension,… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References