ScanAlert Security Advisory – Apache Tomcat can be forced to reveal a complete directory listing for any directory by requesting a mapped file extension prepended with a semicolon, a reserved character. The file does not need to exist. 5.x versions below 5.5.17 may be susceptible to this flaw.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/48468/sa-apacheTomcat.txt
Source: https://packetstormsecurity.com/files/48468/sa-apacheTomcat.txt.html