5

CVE-2005-1754

Exploit
JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter.  NOTE: Sun and Apache dispute this issue.  Sun states: "The report makes references to source code and files that do not exist in the mentioned products.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache Tomcat ≫ Apache Tomcat Version5.0.16
Sun ≫ Javamail Version1.1.3
Sun ≫ Javamail Version1.2
Sun ≫ Javamail Version1.3
Sun ≫ Javamail Version1.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.84% 0.848
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://tomcat.apache.org/security-5.html
http://marc.info/?l=bugtraq&m=111697083812367&w=2
http://www.securityfocus.com/bid/13753
Exploit