PT-2002-2144 · Apache · Apache Tomcat

Published 2002-10-11 · Updated 2022-04-30 · CVE-2002-1148

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.0.4 and 4.1.10 and earlier

Description: The issue allows remote attackers to read source code for server files via a direct request to the org.apache.catalina.servlets.DefaultServlet servlet. A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages.

Recommendations: For Apache Tomcat versions 4.0.4 and 4.1.10 and earlier, consider disabling the org.apache.catalina.servlets.DefaultServlet servlet until a patch is available to prevent remote attackers from reading source code for server files. Restrict access to the default servlet to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2002-1148

DSA-170

GHSA-JXCV-V856-J5VG

Affected Products

Apache Tomcat

References · 24

• 🔥 https://exploit-db.com/exploits/21853 · Exploit
• 🔥 http://securityfocus.com/bid/5786 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1148 · Security Note
• https://osv.dev/vulnerability/GHSA-jxcv-v856-j5vg · Vendor Advisory
• http://debian.org/security/2002/dsa-170 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-217.html · Vendor Advisory
• http://online.securityfocus.com/advisories/4758 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-218.html · Vendor Advisory
• http://iss.net/security_center/static/10175.php · Vendor Advisory
• https://tomcat.apache.org/security-4 · Note
• http://marc.info/?l=bugtraq&m=103288242014253&w=2 · Note
• https://web.archive.org/web/20021027204137/http://iss.net/security_center/static/10175.php · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Note
• https://web.archive.org/web/20070430075037/http://debian.org/security/2002/dsa-170 · Note