Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure

Author: Stefano Di Paola
type: remote
platform: multiple
port: 
date_added: 2008-08-01  
date_updated: 2014-03-10  
verified: 1  
codes: CVE-2008-2370;OSVDB-47463  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 32137.txt  

source: https://www.securityfocus.com/bid/30494/info

Apache Tomcat is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain the contents of sensitive files stored on the server. Information obtained may lead to further attacks.

The following versions are affected:

Tomcat 4.1.0 through 4.1.37
Tomcat 5.5.0 through 5.5.26
Tomcat 6.0.0 through 6.0.16

Tomcat 3.x, 4.0.x, and 5.0.x may also be affected.

http://www.example.com/page.jsp?blah=/../WEB-INF/web.xml