VulnerabilityModified

CVE-2005-1754

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter.

MEDIUM 5.0EPSS 2.84%

Does this matter?

Lower severity and a low EPSS score (2.84%). Track it; it rarely justifies an emergency change on its own.

Description

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 2.84% probability · 86th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: apache tomcat/apache tomcat · sun/javamail
Source: cve@mitre.org

References

http://marc.info/?l=bugtraq&m=111697083812367&w=2
http://tomcat.apache.org/security-5.html
http://www.securityfocus.com/bid/13753Exploit
http://marc.info/?l=bugtraq&m=111697083812367&w=2
http://tomcat.apache.org/security-5.html
http://www.securityfocus.com/bid/13753Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.