CVE-2006-3835: Infoleak
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Other sources
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3835?
CVE-2006-3835 is considered medium severity due to the potential for unauthorized directory listing.
How do I fix CVE-2006-3835?
To fix CVE-2006-3835, upgrade Apache Tomcat to version 5.5.17 or later.
Which versions of Apache Tomcat are affected by CVE-2006-3835?
CVE-2006-3835 affects Apache Tomcat versions 5.0.28, 5.5.7, 5.5.9, 5.5.12, and 5.5.16.
Can CVE-2006-3835 be exploited remotely?
Yes, CVE-2006-3835 can be exploited remotely by attackers to list directories.
What kind of impact can CVE-2006-3835 have on web applications?
CVE-2006-3835 can lead to information disclosure by allowing attackers to enumerate files and directories on the server.