PT-2003-1328 · Apache+1 · Jakarta Tomcat+2

Publicado 2003-02-07 · Atualizado 2022-04-29 · CVE-2003-0043

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat versions prior to 3.3.1a

Description The issue allows remote attackers to read portions of some files through the web.xml file, as it is processed with trusted privileges when used with JDK 1.3.1 or earlier. This enables files outside of the web application to be read, even when running under a security manager.

Recommendations For Jakarta Tomcat versions prior to 3.3.1a, update to version 3.3.1a or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-250

Identificadores relacionados

CVE-2003-0043

DSA-246

GHSA-CVX5-7VC7-RG77

Produtos afetados

Apache Tomcat

Jdk

Jakarta Tomcat

Referências · 17

• https://github.com/apache/tomcat · Nota
• http://ciac.org/ciac/bulletins/n-060.shtml · Nota
• https://web.archive.org/web/20140627151430/http://securityfocus.com/advisories/5111 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0043 · Nota
• https://tomcat.apache.org/security-3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0043 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-cvx5-7vc7-rg77 · Aviso do Fabricante
• https://web.archive.org/web/20030819144200/http://ciac.org/ciac/bulletins/n-060.shtml · Nota
• https://web.archive.org/web/20030804165204/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Nota
• https://web.archive.org/web/20030810045410/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a · Nota
• https://web.archive.org/web/20131213024606/http://securityfocus.com/bid/6722 · Nota
• http://debian.org/security/2003/dsa-246 · Aviso do Fabricante
• http://securityfocus.com/advisories/5111 · Aviso do Fabricante
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a · Aviso do Fabricante
• http://securityfocus.com/bid/6722 · Nota