CVE-2006-3835

CVE-2006-3835 describes an information disclosure vulnerability in Apache Tomcat 5 prior to version 5.5.17, allowing remote attackers to list directory contents. This flaw is triggered by appending a semicolon followed by a filename with a mapped extension to a URL, such as /;index.jsp. With a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), it is a medium-severity vulnerability indicating low attack complexity and potential for partial confidentiality impact. While not on the KEV catalog and lacking Metasploit or Nuclei exploits, an ExploitDB entry (EDB-28254) exists, suggesting proof-of-concept code is publicly available, though community discussion and media coverage are minimal.