Vulnerability Name:
CVE-2005-4836 (CCN-40736)
Assigned:
2005-12-31
Published:
2005-12-31
Updated:
2019-03-25
Summary:
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
CVSS v3 Severity:
3.7 Low
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
Low
Integrity (I):
None
Availibility (A):
None
CVSS v2 Severity:
7.8 High
(CVSS v2 Vector:
AV:N/AC:L/Au:N/C:C/I:N/A:N
)
6.3 Medium
(Temporal CVSS v2 Vector:
AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:U/RC:UR
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
Complete
Integrity (I):
None
Availibility (A):
None
2.6 Low
(CCN CVSS v2 Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N
)
2.1 Low
(CCN Temporal CVSS v2 Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N/E:U/RL:U/RC:UR
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
High
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
None
Availibility (A):
None
Vulnerability Type:
CWE-200
Vulnerability Consequences:
Obtain Information
References:
Source: MITRE
Type: CNA
CVE-2005-4836
Source: CCN
Type: Apache Tomcat Web site
Apache Tomcat 4.x vulnerabilities
Source: CONFIRM
Type: UNKNOWN
http://tomcat.apache.org/security-4.html
Source: CCN
Type: OSVDB ID: 34880
Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
Source: BID
Type: UNKNOWN
28483
Source: CCN
Type: BID-28483
Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
Source: XF
Type: UNKNOWN
tomcat-httpconnector-info-disclosure(40736)
Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
Source: CCN
Type: IBM Security Bulletin 6858013 (Tivoli Application Dependency Discovery Manager)
TADDM affected by multiple vulnerabilities due to Apache Tomcat libraries
Vulnerable Configuration:
Configuration 1
:
cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.16:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.17:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.18:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.19:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.20:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.21:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.22:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.23:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.25:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.26:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.27:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.28:alpha:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.29:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.29:alpha:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.30:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.32:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.33:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.34:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.35:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.36:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.37:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.39:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.40:*:*:*:*:*:*:*
Configuration CCN 1
:
cpe:/a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.25:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.0:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.10:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.11:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.12:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.13:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.14:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.15:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.16:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.17:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.18:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.21:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.22:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.23:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.24:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.26:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.27:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.29:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.30:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.4:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.5:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.6:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.7:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.8:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.0.9:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
OR
cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
AND
cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.3.0.0:*:*:*:*:*:*:*
Denotes that component is vulnerable
BACK
apache
tomcat 4.1.15
apache
tomcat 4.1.16
apache
tomcat 4.1.17
apache
tomcat 4.1.18
apache
tomcat 4.1.19
apache
tomcat 4.1.20
apache
tomcat 4.1.21
apache
tomcat 4.1.22
apache
tomcat 4.1.23
apache
tomcat 4.1.24
apache
tomcat 4.1.25
apache
tomcat 4.1.26
apache
tomcat 4.1.27
apache
tomcat 4.1.28 alpha
apache
tomcat 4.1.29
apache
tomcat 4.1.29 alpha
apache
tomcat 4.1.30
apache
tomcat 4.1.31
apache
tomcat 4.1.32
apache
tomcat 4.1.33
apache
tomcat 4.1.34
apache
tomcat 4.1.35
apache
tomcat 4.1.36
apache
tomcat 4.1.37
apache
tomcat 4.1.39
apache
tomcat 4.1.40
apache
tomcat 5.5.4
apache
tomcat 5.0.19
apache
tomcat 4.1.24
apache
tomcat 5.0.28
apache
tomcat 5.5.12
apache
tomcat 5.5.9
apache
tomcat 5.5.7
apache
tomcat 5.5.20
apache
tomcat 5.0.25
apache
tomcat 5.5.17
apache
tomcat 5.0.0
apache
tomcat 4.1.15
apache
tomcat 4.1.28
apache
tomcat 4.1.3 beta
apache
tomcat 4.1.31
apache
tomcat 4.1.9 beta
apache
tomcat 5.0.1
apache
tomcat 5.0.10
apache
tomcat 5.0.11
apache
tomcat 5.0.12
apache
tomcat 5.0.13
apache
tomcat 5.0.14
apache
tomcat 5.0.15
apache
tomcat 5.0.16
apache
tomcat 5.0.17
apache
tomcat 5.0.18
apache
tomcat 5.0.2
apache
tomcat 5.0.21
apache
tomcat 5.0.22
apache
tomcat 5.0.23
apache
tomcat 5.0.24
apache
tomcat 5.0.26
apache
tomcat 5.0.27
apache
tomcat 5.0.29
apache
tomcat 5.0.3
apache
tomcat 5.0.30
apache
tomcat 5.0.4
apache
tomcat 5.0.5
apache
tomcat 5.0.6
apache
tomcat 5.0.7
apache
tomcat 5.0.8
apache
tomcat 5.0.9
apache
tomcat 5.5.0
apache
tomcat 5.5.1
apache
tomcat 5.5.10
apache
tomcat 5.5.11
apache
tomcat 5.5.13
apache
tomcat 5.5.14
apache
tomcat 5.5.15
apache
tomcat 5.5.16
apache
tomcat 5.5.18
apache
tomcat 5.5.19
apache
tomcat 5.5.2
apache
tomcat 5.5.21
apache
tomcat 5.5.22
apache
tomcat 5.5.3
apache
tomcat 5.5.5
apache
tomcat 5.5.6
apache
tomcat 5.5.8
apache
tomcat 6.0.9
ibm
tivoli application dependency discovery manager 7.3.0.0