CVE-2005-2006 JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), which reveals the installation path or (2) with a % (percen...
MediumCVSS 5.0
EPSS 9.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), which reveals the installation path or (2) with a % (percent) before a filename, which reveals the contents of the file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jboss | = 3.2.2 | No fix listed |
| jboss | = 3.2.3 | No fix listed |
| jboss | = 3.2.4 | No fix listed |
| jboss | = 3.2.5 | No fix listed |
| jboss | = 3.2.6 | No fix listed |
| jboss | = 3.2.7 | No fix listed |
| jboss | = 4.0.2 | No fix listed |
References
- 20060720 Cisco MARS < 4.2.1 remote compromise mailing-list
- 20050617 JBOSS 3.2.2-3.2.7 / 4.0.2 installation path disclosure / config disclosure / version fingerprinting mailing-list
- 15746 third-party-advisory vendor-advisory
- 17559 third-party-advisory
- 18789 third-party-advisory
- 439 third-party-advisory
- 1015605 vdb-entry
- 20060720 Cisco MARS < 4.2.1 remote compromise mailing-list
- 13985 vdb-entry
- ADV-2005-0815 vdb-entry
- ADV-2006-0497 vdb-entry
- SSRT061108 vendor-advisory