PT-2000-1605 · Apache · Jakarta Tomcat+1

Publicado 2000-07-20 · Atualizado 2022-02-22 · CVE-2000-0672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat (affected versions not specified)

Description The issue concerns the default configuration of Jakarta Tomcat, where access to the /admin context is not restricted. This allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory. Specifically, the admin context is not protected, enabling an attacker to mount an arbitrary file system path as a context. As a result, any files accessible from this file system path to the account under which Tomcat is running are then visible to the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2000-0672

Produtos afetados

Apache Tomcat

Jakarta Tomcat

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2000-07/0309.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0672 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0672 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5160 · Nota
• http://securityfocus.com/bid/1548 · Nota
• https://tomcat.apache.org/security-3 · Nota