PT-2002-1544 · Apache · Apache Tomcat

Published 2002-08-12 · Updated 2022-04-30 · CVE-2002-0493

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat (affected versions not specified)

Description The issue arises when Apache Tomcat encounters errors while reading the web.xml file, potentially leading to the server starting without proper security settings. This could allow attackers to bypass intended restrictions. Specifically, if errors occur during the parsing of web.xml and Tomcat is configured to use a security manager, it is possible for Tomcat to start without the security manager in place.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-254

Related Identifiers

CVE-2002-0493

GHSA-P543-JG43-9PM5

Affected Products

Apache Tomcat

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2002-0493 · Security Note
• https://osv.dev/vulnerability/GHSA-p543-jg43-9pm5 · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Note
• http://apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail%40icarus.apache.org%3E · Note
• http://iss.net/security_center/static/9863.php · Note
• https://web.archive.org/web/20020903071650/http://iss.net/security_center/static/9863.php · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Note
• https://tomcat.apache.org/security-4 · Note
• http://marc.info/?l=bugtraq&m=101709002410365&w=2 · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0493 · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Note