CVE-2005-4703 - Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive informatio

CVE-2005-4703

Summary

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.

References

Vulnerable Configurations

cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 25-03-2019 - 11:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bid	28484
confirm	http://tomcat.apache.org/security-4.html
misc	http://osvdb.org/ref/20/20033-tomcat-dos-path_disclosure.txt
mlist	[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
osvdb	20033
xf	tomcat-msdos-path-disclosure(42914)

Last major update

25-03-2019 - 11:29

Published

31-12-2005 - 05:00

Last modified

25-03-2019 - 11:29