CVE-2005-1754

no score yetEPSS 2.8%

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products.

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2005-12-31
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apache_tomcat:apache_tomcat
sun:javamail

References

http://marc.info/?l=bugtraq&m=111697083812367&w=2
http://tomcat.apache.org/security-5.html
http://www.securityfocus.com/bid/13753
http://marc.info/?l=bugtraq&m=111697083812367&w=2
http://tomcat.apache.org/security-5.html

Check your stack JSON