| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 5.0.0, < 5.5.17 | 5.5.17 |
| tomcat | = 5.0.28= 5.5.12= 5.5.16= 5.5.7= 5.5.9 |
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free