CVE-2006-3835Tomcat Information Disclosure
Apache Tomcat Reveals Directories
Published May 1, 2022 · Updated Apr 4, 2025 · Also known as GHSA-wfj7-mhr5-pcwq
Key Facts
Routine patching- CVE-2006-3835 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Tomcat (Apache), org.apache.tomcat:tomcat (maven), ant (redhat) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 46% probability of exploitation in the next 30 days.
- Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, avalon-logkit 0:1.2-2jpp_4rh, axis 0:1.2.1-1jpp_3rh.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS (30-day exploit likelihood)
46%
Higher than 98.8% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
39/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2006-3835
- advisoryRHSA-2007:0326
- advisoryRHSA-2007:0340
- advisoryRHSA-2007:1069
- advisoryRHSA-2008:0261
- advisoryRHSA-2008:0524
Description
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Affected Products
39 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 5.0.28, 5.5.12, 5.5.16, 5.5.7, 5.5.9 | n/a |
| org.apache.tomcat:tomcatmaven | >= 5.0.0 | 5.5.17 |
| antredhat | See advisory | 0:1.6.5-1jpp_1rh |
| avalon-logkitredhat | See advisory | 0:1.2-2jpp_4rh |
| axisredhat | See advisory | 0:1.2.1-1jpp_3rh |
Patched Releases
ant
0:1.6.5-1jpp_1rh
avalon-logkit
0:1.2-2jpp_4rh
axis
0:1.2.1-1jpp_3rh
classpathx-jaf
0:1.0-2jpp_6rh
classpathx-mail
0:1.1.1-2jpp_8rh
geronimo-specs
0:1.0-0.M4.1jpp_10rh
jabberd
0:2.0s10-3.38.rhn
jakarta-commons-modeler
0:2.0-3jpp_2rh
jakarta-commons-pool
0:1.2-2jpp_2rh
java
1.4.2-ibm-0:1.4.2.10-1jpp.2.el3, 1.4.2-ibm-0:1.4.2.10-1jpp.2.el4
jfreechart
0:0.9.20-3.rhn
log4j
0:1.2.12-1jpp_1rh
mx4j
1:3.0.1-1jpp_4rh
openmotif21
0:2.1.30-11.RHEL4.6
org.apache.tomcat:tomcat
5.5.17
pcsc-lite
0:1.3.3-3.el4
perl-Crypt-CBC
0:2.24-1.el3, 0:2.24-1.el4
rhn-apache
0:1.3.27-36.rhn.rhel4
rhn-modjk
0:1.2.23-2rhn.rhel4
rhn-modperl
0:1.29-16.rhel3
rhn-modssl
0:2.8.12-8.rhn.10.rhel4
rhpki-ca
0:7.3.0-20.el4
rhpki-java-tools
0:7.3.0-10.el4
rhpki-kra
0:7.3.0-14.el4
rhpki-manage
0:7.3.0-19.el4
Timeline
Publicly disclosed
May 1, 2022
Last updated
Apr 4, 2025
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- advisorynvd.nist.gov · CVE-2006-3835
- advisoryRHSA-2007:0326
- advisoryRHSA-2007:0340
- advisoryRHSA-2007:1069
- advisoryRHSA-2008:0261
FAQ
Common Questions.
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Affected: Tomcat (Apache) versions 5.0.28, 5.5.12, 5.5.16, 5.5.7, 5.5.9; org.apache.tomcat:tomcat (maven) versions >= 5.0.0; ant (redhat), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, avalon-logkit 0:1.2-2jpp_4rh, axis 0:1.2.1-1jpp_3rh.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2006-3835 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo