GitHub Advisoryadvisory · Maven

GHSA-x89r-2wjq-mj7x Apache Tomcat Discloses MS-DOS Pathname

MEDIUM Published 2022-05-01 Modified 2023-09-18 Official page ↗
Aliases
CVE-2005-4703
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-09-18

Affected packages

• Maven org.apache.tomcat:tomcat: <= 4.0.3 (no fix yet)

Description

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by `lpt9.xtp` using Nikto.

Related

Alias · CVE (1)

  • CVE-2005-4703 Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References