Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon…
Priority MEDIUM 53CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Why it matters now
EPSS 0.48051 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.17Red Hat: 6 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.0.0 to before 5.5.17 | 5.5.17 | Patch available | GHSA-wfj7-mhr5-pcwq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.0.0 to before 5.5.17 Fixed in 5.5.17 Patch available GHSA-wfj7-mhr5-pcwq
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:* | 5.0.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* | 5.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* | 5.5.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* | 5.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* | 5.5.16 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.0.28:*:*:*:*:*:*:* Versions 5.0.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
Remediation
- Fix · GHSA-wfj7-mhr5-pcwq org.apache.tomcat:tomcat (Maven) Fixed in 5.5.17 Advisory →
Red Hat 6 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2008:0524 Released 2008-06-30 · Red Hat rating LowRed Hat Network Satellite Server security update
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
- RHSA-2008:0261 Released 2008-05-20 · Red Hat rating ModerateRed Hat Network Satellite Server security update
- Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
Show 3 more Red Hat advisories
- RHSA-2007:1069 Released 2007-11-26 · Red Hat rating Moderatetomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- RHSA-2007:0326 Released 2007-05-21 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4ES jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4WS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- RHSA-2007:0340 Released 2007-05-08 · Red Hat rating Importanttomcat security update
- Red Hat Application Server 3AS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3ES tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3WS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server 3AS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3ES | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3WS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server v2 4AS | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2007:0326 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0261 |
| Red Hat Satellite v 4.0 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
| Red Hat Satellite v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
Timeline
- 2026-10-02 Threatist record created from CVE-2006-3835
- 2026-10-03 Alias added: GHSA-wfj7-mhr5-pcwq
References
Other 23
- http://tomcat.apache.org/security-4.html
- http://www.sec-consult.com/289.html
- ADV-2008-1979
- ADV-2007-1727
- ADV-2009-0233
- http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
- http://tomcat.apache.org/security-5.html
- http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- https://web.archive.org/web/20200517122628/http://www.securityfocus.com/archive/1/500396/100/0/threaded
- https://web.archive.org/web/20200517153851/http://www.securityfocus.com/archive/1/500412/100/0/threaded
- https://web.archive.org/web/20200525234537/http://securitytracker.com/id?1016576
- https://web.archive.org/web/20200526144006/http://www.securityfocus.com/archive/1/507729/100/0/threaded
- https://web.archive.org/web/20200526152646/http://www.securityfocus.com/archive/1/468048/100/0/threaded
- https://web.archive.org/web/20200526165235/http://www.securityfocus.com/bid/19106
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2006-3835 · CVE Program
- CVE-2006-3835 · NVD
- FIRST EPSS
- GHSA-wfj7-mhr5-pcwq · GitHub Advisory Database · CC BY 4.0
- CVE-2006-3835 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences