PT-2001-2071 · Apache · Jakarta Tomcat+1

Publicado

2001-11-22

·

Atualizado

2022-04-30

·

CVE-2001-0917

CVSS v4.0

6.9

Média

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Jakarta Tomcat version 4.0.1
Description The issue allows remote attackers to reveal physical path information. This can be achieved by requesting a long URL with a .JSP extension or by making specific requests for JSP files, such as those where the file name is preceded by '+/','>/','</' or '%20/'.
Recommendations For Jakarta Tomcat version 4.0.1, consider restricting access to JSP files to minimize the risk of path disclosure until a patch is available. Avoid using long file names for JSP files and be cautious with requests that include special characters such as '+/','>/','</' or '%20/' in the file name.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2001-0917
GHSA-2W2W-CV3H-RR38

Produtos afetados

Apache Tomcat
Jakarta Tomcat