CVE-2005-1754: Infoleak
DISPUTED JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-1754?
CVE-2005-1754 has been disputed, with no consensus on its severity from Sun and Apache.
How do I fix CVE-2005-1754?
To mitigate CVE-2005-1754, consider updating to a more recent version of Apache Tomcat or JavaMail that addresses this vulnerability.
Which versions of Apache Tomcat are affected by CVE-2005-1754?
CVE-2005-1754 affects Apache Tomcat version 5.0.16.
Which versions of JavaMail are affected by CVE-2005-1754?
CVE-2005-1754 affects JavaMail versions 1.1.3, 1.2, 1.3, and 1.3.2.
Can remote attackers exploit CVE-2005-1754?
Yes, remote attackers can exploit CVE-2005-1754 to read arbitrary files via a crafted Download parameter.