PT-2001-2071 · Apache · Jakarta Tomcat+1

Published

2001-11-22

·

Updated

2022-04-30

·

CVE-2001-0917

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Jakarta Tomcat version 4.0.1
Description The issue allows remote attackers to reveal physical path information. This can be achieved by requesting a long URL with a .JSP extension or by making specific requests for JSP files, such as those where the file name is preceded by '+/','>/','</' or '%20/'.
Recommendations For Jakarta Tomcat version 4.0.1, consider restricting access to JSP files to minimize the risk of path disclosure until a patch is available. Avoid using long file names for JSP files and be cautious with requests that include special characters such as '+/','>/','</' or '%20/' in the file name.

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2001-0917
GHSA-2W2W-CV3H-RR38

Affected Products

Apache Tomcat
Jakarta Tomcat