CVE-2005-2006: Medium severity JBOSS JBoss vulnerability

Published Jun 17, 2005

Updated

JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), which reveals the installation path or (2) with a % (percent) before a filename, which reveals the contents of the file.

Affected Software

7 affected components

JBOSS JBoss=3.2.2

JBOSS JBoss=3.2.7

JBOSS JBoss=3.2.3

JBOSS JBoss=3.2.4

JBOSS JBoss=3.2.6

JBOSS JBoss=3.2.5

JBOSS JBoss=4.0.2

Event History

Jun 17, 2005

CVE Published

04:00 AM

Jun 20, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2006?

CVE-2005-2006 is classified as a high severity vulnerability due to the potential exposure of sensitive information.

How can CVE-2005-2006 be exploited?

CVE-2005-2006 can be exploited by remote attackers using specific GET requests to reveal installation paths or file contents.

What versions of JBoss are affected by CVE-2005-2006?

JBoss versions 3.2.2 through 3.2.7 and 4.0.2 are affected by CVE-2005-2006.

How do I fix CVE-2005-2006?

To fix CVE-2005-2006, upgrade to a patched version of JBoss that addresses this vulnerability.

What kind of data does CVE-2005-2006 expose?

CVE-2005-2006 can expose sensitive information such as installation paths and file contents from the server.