Apache Tomcat Reveals Directories

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Advisories 6

• RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2007:0326 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
• RHSA-2007:0340 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
• RHSA-2007:1069 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Jan 7, 2026

References

• 19106 vdb-entry
• http://tomcat.apache.org/security-4.html
• 30908 third-party-advisory
• 37297 third-party-advisory
• 239312 vendor-advisory
• 30899 third-party-advisory
• http://www.sec-consult.com/289.html
• ADV-2008-1979 vdb-entry
• 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) mailing-list
• ADV-2007-1727 vdb-entry
• 33668 third-party-advisory
• apache-tomcat-url-information-disclosure(27902) vdb-entry
• 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities mailing-list
• 20070509 SEC Consult SA-20070509-0 :: Multiple vulnerabilites in Nokia Intellisync Mobile Suite & Wireless Email Express mailing-list
• ADV-2009-0233 vdb-entry
• SUSE-SR:2009:004 vendor-advisory
• http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
• 25212 third-party-advisory
• 20091107 ToutVirtual VirtualIQ Multiple Vulnerabilities mailing-list
• 1016576 vdb-entry
• 20060721 Directory Listing in Apache Tomcat 5.x.x mailing-list
• http://tomcat.apache.org/security-5.html
• nokia-tomcat-source-code-disclosure(34183) vdb-entry
• RHSA-2008:0261 vendor-advisory
• http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
• http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
• http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
• [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
• [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
• [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list