Description

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

Remediation

References

CVE-2006-3835

Related Vulnerabilities

WordPress Plugin dsIDXpress IDX Multiple Unspecified Vulnerabilities (2.1.32)

MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13075)

Oracle Database Server CVE-2017-10120 Vulnerability (CVE-2017-10120)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-45387)

Atlassian Jira Incorrect Authorization Vulnerability (CVE-2019-3403)

Severity

Medium

Classification

CVE-2006-3835

Tags

Missing Update Known Vulnerabilities