Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Apache Tomcat 5 allows attackers to list directory contents via semicolon in URL

CVE-2006-3835 · published 20 years ago
Summary

Apache Tomcat 5 versions before 5.5.17 have a security weakness that could allow an attacker to see a list of files in a directory by manipulating the URL. This could lead to sensitive information being exposed. Update to a fixed version of Apache Tomcat 5.5.17 or later to fix this issue.

What to do
  • Update apache org.apache.tomcat:tomcat to version 5.5.17.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.tomcat:tomcat >= 5.0.0, < 5.5.17
Fix: upgrade to 5.5.17
– apache tomcat 5.0.28
5.5.7
5.5.9
5.5.12
5.5.16
cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
Original advisory text
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;hel...
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
References
Severity
5.0 Medium
Exploitation
48% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published25 Jul 2006
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-wfj7-mhr5-pcwq · GHSA
CVE-2006-3835 · NVD
Track software like this
Free during beta