Published: 17/06/2005 Updated: 19/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 506

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

JBOSS 3.2.2 up to and including 3.2.7 and 4.0.2 allows remote malicious users to obtain sensitive information via a GET request (1) with a "%." (percent dot), which reveals the installation path or (2) with a % (percent) before a filename, which reveals the contents of the file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jboss jboss 3.2.2
jboss jboss 3.2.5
jboss jboss 3.2.6
jboss jboss 3.2.7
jboss jboss 4.0.2
jboss jboss 3.2.3
jboss jboss 3.2.4

source: wwwsecurityfocuscom/bid/13985/info JBoss is prone to a remote information-disclosure vulnerability The issue occurs in the 'orgjbosswebWebServer' class and is due to a lack of sufficient sanitization of user-supplied request data Information that attackers can harvest through leveraging this issue may aid in further attacks ...

clusterd clusterd is an open source application server attack toolkit Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack See the wiki for more information Requirements Python >= 27x Requests >= 22x Installation The re

application server attack toolkit

clusterd clusterd is an open source application server attack toolkit Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack See the wiki for more information Requirements Python >= 27x Requests >= 22x Installation The re

NVD-CWE-Other http://secunia.com/advisories/15746 http://secunia.com/advisories/17559 http://www.securityfocus.com/bid/13985 http://securitytracker.com/id?1015605 http://secunia.com/advisories/18789 http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0424.html http://securityreason.com/securityalert/439 http://www.vupen.com/english/advisories/2006/0497 http://www.vupen.com/english/advisories/2005/0815 http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00597967 http://marc.info/?l=bugtraq&m=111911095424496&w=2 http://www.securityfocus.com/archive/1/440641/100/100/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/25842/https://github.com/hatRiot/clusterd

CVE-2005-2006

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect