GHSA-qrcx-p4rr-g48h

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qrcx-p4rr-g48h/GHSA-qrcx-p4rr-g48h.json
Aliases
  • CVE-2005-4836
Published
2022-05-01T02:31:23Z
Modified
2023-09-18T23:51:34Z
Details

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

References

Affected packages

Maven / org.apache.tomcat:tomcat

Source Details

Package Name
org.apache.tomcat:tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.15
Last affected
4.1.40

Ecosystem specific 

{
    "affected_functions": [
        ""
    ]
}