CVE-2006-3835

描述

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (`;`) preceding a filename with a mapped extension, as demonstrated by URLs ending with `/;index.jsp` and `/;help.do`.

如何修補 CVE-2006-3835

要修補 CVE-2006-3835,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 5.5.17 或更新版本

CVE-2006-3835 正在被利用嗎?

中等 — EPSS 為 45.6%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 5.0.0, < 5.5.17

參考連結(27)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2006-3835
• PATCHgithub.com/apache/tomcat
• WEBarchives.neohapsis.com/archives/fulldisclosure/2006-07/0467.html
• WEBcommunity.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx