PT-2002-2144 · Apache · Apache Tomcat

Publicado 2002-10-11 · Atualizado 2022-04-30 · CVE-2002-1148

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.0.4 and 4.1.10 and earlier

Description: The issue allows remote attackers to read source code for server files via a direct request to the org.apache.catalina.servlets.DefaultServlet servlet. A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages.

Recommendations: For Apache Tomcat versions 4.0.4 and 4.1.10 and earlier, consider disabling the org.apache.catalina.servlets.DefaultServlet servlet until a patch is available to prevent remote attackers from reading source code for server files. Restrict access to the default servlet to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2002-1148

DSA-170

GHSA-JXCV-V856-J5VG

Produtos afetados

Apache Tomcat

Referências · 24

• 🔥 https://exploit-db.com/exploits/21853 · Exploit
• 🔥 http://securityfocus.com/bid/5786 · Exploit
• https://tomcat.apache.org/security-4 · Nota
• http://marc.info/?l=bugtraq&m=103288242014253&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1148 · Nota de Segurança
• https://web.archive.org/web/20021027204137/http://iss.net/security_center/static/10175.php · Nota
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Nota
• https://web.archive.org/web/20070430075037/http://debian.org/security/2002/dsa-170 · Nota
• https://osv.dev/vulnerability/GHSA-jxcv-v856-j5vg · Aviso do Fabricante
• https://web.archive.org/web/20040817035804/http://rhn.redhat.com/errata/RHSA-2002-218.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1148 · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E · Nota