CVE-2005-4703: Apache Tomcat

Medium severity, CVSS 5.0. EPSS: 25.7% chance of exploitation in the next 30 days.

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.

Affected products

• Apache Tomcat: version 4.0.3 only

Published 2005-12-31. Last modified 2026-06-16.