Search for vulnerabilities
Vulnerability details: VCID-asn2-b2sv-aaap
Vulnerability ID VCID-asn2-b2sv-aaap
Aliases CVE-2005-4703
GHSA-x89r-2wjq-mj7x
Summary Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.00297 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.18347 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
epss 0.25518 https://api.first.org/data/v1/epss?cve=CVE-2005-4703
generic_textual MODERATE https://exchange.xforce.ibmcloud.com/vulnerabilities/42914
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-x89r-2wjq-mj7x
cvssv3.1 4.2 https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
cvssv3.1 4.2 https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
cvssv3.1 4.2 https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
cvssv3.1 4.2 https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
cvssv3.1 4.2 https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
cvssv3.1 4.2 https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2005-4703
generic_textual MODERATE https://web.archive.org/web/20080511145425/http://www.securityfocus.com/bid/28484
cvssv3.1 4.2 http://tomcat.apache.org/security-4.html
generic_textual MODERATE http://tomcat.apache.org/security-4.html
Reference id Reference type URL
http://osvdb.org/ref/20/20033-tomcat-dos-path_disclosure.txt
https://api.first.org/data/v1/epss?cve=CVE-2005-4703
https://exchange.xforce.ibmcloud.com/vulnerabilities/42914
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
https://web.archive.org/web/20080511145425/http://www.securityfocus.com/bid/28484
http://tomcat.apache.org/security-4.html
http://www.osvdb.org/20033
http://www.securityfocus.com/bid/28484
cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
CVE-2005-4703 https://nvd.nist.gov/vuln/detail/CVE-2005-4703
CVE-2005-4703;OSVDB-20033 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/31551.txt
CVE-2005-4703;OSVDB-20033 Exploit https://www.securityfocus.com/bid/28484/info
GHSA-x89r-2wjq-mj7x https://github.com/advisories/GHSA-x89r-2wjq-mj7x
Data source Exploit-DB
Date added Oct. 14, 2005
Description Apache Tomcat 4.0.3 - Requests Containing MS-DOS Device Names Information Disclosure
Ransomware campaign use Known
Source publication date Oct. 14, 2005
Exploit type remote
Platform multiple
Source update date Feb. 11, 2014
Source URL https://www.securityfocus.com/bid/28484/info
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2005-4703
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Found at http://tomcat.apache.org/security-4.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.64659
EPSS Score 0.00258
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.