PT-2002-2728 · Apache · Apache Tomcat

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2007

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 3.2.3 through 3.2.4

Description The issue allows remote attackers to obtain sensitive system information, such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in specific directories. Non-standard requests to the sample applications installed by default could result in unexpected directory listings or disclosure of the full file system path for a JSP.

Recommendations For Apache Tomcat versions 3.2.3 and 3.2.4, consider restricting access to the test/jsp, samples/jsp, and examples/jsp directories, as well as the test/realPath.jsp servlet, to minimize the risk of exploitation. As a temporary workaround, consider disabling the sample applications installed by default until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2002-2007

Affected Products

Apache Tomcat

References · 16

• 🔥 http://securityfocus.com/bid/4876 · Exploit
• 🔥 https://exploit-db.com/exploits/21492 · Exploit
• 🔥 http://securityfocus.com/bid/4878 · Exploit
• 🔥 https://exploit-db.com/exploits/21490 · Exploit
• 🔥 http://securityfocus.com/bid/4877 · Exploit
• 🔥 https://exploit-db.com/exploits/21491 · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2007 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2007 · Note
• https://tomcat.apache.org/security-3 · Note
• http://procheckup.com/security_info/vuln_pr0206.html · Note
• http://procheckup.com/security_info/vuln_pr0207.html · Note
• http://iss.net/security_center/static/9208.php · Note
• http://kb.cert.org/vuls/id/116963 · Note