PT-2002-2728 · Apache · Apache Tomcat

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2007

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 3.2.3 through 3.2.4

Description The issue allows remote attackers to obtain sensitive system information, such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in specific directories. Non-standard requests to the sample applications installed by default could result in unexpected directory listings or disclosure of the full file system path for a JSP.

Recommendations For Apache Tomcat versions 3.2.3 and 3.2.4, consider restricting access to the test/jsp, samples/jsp, and examples/jsp directories, as well as the test/realPath.jsp servlet, to minimize the risk of exploitation. As a temporary workaround, consider disabling the sample applications installed by default until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-2007

Produtos afetados

Apache Tomcat

Referências · 16

• 🔥 http://securityfocus.com/bid/4876 · Exploit
• 🔥 https://exploit-db.com/exploits/21492 · Exploit
• 🔥 http://securityfocus.com/bid/4878 · Exploit
• 🔥 https://exploit-db.com/exploits/21490 · Exploit
• 🔥 http://securityfocus.com/bid/4877 · Exploit
• 🔥 https://exploit-db.com/exploits/21491 · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2007 · Nota
• https://tomcat.apache.org/security-3 · Nota
• http://procheckup.com/security_info/vuln_pr0206.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2007 · Nota de Segurança
• http://procheckup.com/security_info/vuln_pr0207.html · Nota
• http://iss.net/security_center/static/9208.php · Nota
• http://kb.cert.org/vuls/id/116963 · Nota