What is CVE-2005-4836?

CVE-2005-4836 is a vulnerability in Apache Tomcat, classified under Information Disclosure. Published 2005-12-31.

Is CVE-2005-4836 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Apache Tomcat

CVE-2005-4836

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

Vulnerability class: Information Disclosure

EPSS: 0.035 (87.9th percentile) — read the EPSS interpretation.

Affected products

Apache Tomcat — versions 4.1.15, 4.1.16, 4.1.17
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

m3n0sd0n4ld/uCVE

References

secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2005-4836?: CVE-2005-4836 is a vulnerability in Apache Tomcat, classified under Information Disclosure. Published 2005-12-31.
Is CVE-2005-4836 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.