← Database

CVE-2005-4836

HIGH CVSS: 7.8 Published: 2005-12-31 Modified: 2026-06-16

Description

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.

Affected Platforms

Apache Tomcat

Weakness Type

CWE-200

References