Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure

🗓️ 01 Aug 2008 00:00:00Reported by Stefano Di PaolaType

Apache Tomcat 6.0.16 'RequestDispatcher' Information Disclosure vulnerabilit

Reporter	Title	Published	Views	Family All 97
IBM Security Bulletins	Security Bulletin: TADDM affected by multiple vulnerabilities due to Apache Tomcat libraries	26 Mar 202503:33	–	ibm
Tenable Nessus	Apache Tomcat 4.1.x < 4.1.39 / 5.5.x < 5.5.27 / 6.0.x < 6.0.18 Multiple Vulnerabilities	5 Aug 200800:00	–	nessus
Tenable Nessus	CentOS 5 : tomcat5 (CESA-2008:0648)	6 Jan 201000:00	–	nessus
Tenable Nessus	F5 Networks BIG-IP : Apache Tomcat information disclosure vulnerability (SOL9110)	10 Oct 201400:00	–	nessus
Tenable Nessus	Fedora 9 : tomcat6-6.0.18-1.1.fc9 (2008-7977)	12 Sep 200800:00	–	nessus
Tenable Nessus	Fedora 9 : tomcat5-5.5.27-0jpp.2.fc9 (2008-8113)	17 Sep 200800:00	–	nessus
Tenable Nessus	Fedora 8 : tomcat5-5.5.27-0jpp.2.fc8 (2008-8130)	17 Sep 200800:00	–	nessus
Tenable Nessus	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	10 Oct 200800:00	–	nessus
Tenable Nessus	Mandriva Linux Security Advisory : tomcat5 (MDVSA-2008:188)	23 Apr 200900:00	–	nessus
Tenable Nessus	MiracleLinux 3 : tomcat5-5.5.23-0jpp.7.1.1AXS3 (AXSA:2008-90:02)	14 Jan 202600:00	–	nessus

source: https://www.securityfocus.com/bid/30494/info

Apache Tomcat is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain the contents of sensitive files stored on the server. Information obtained may lead to further attacks.

The following versions are affected:

Tomcat 4.1.0 through 4.1.37
Tomcat 5.5.0 through 5.5.26
Tomcat 6.0.0 through 6.0.16

Tomcat 3.x, 4.0.x, and 5.0.x may also be affected.

http://www.example.com/page.jsp?blah=/../WEB-INF/web.xml

10 Mar 2014 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25

EPSS0.52716