PT-2003-1299 · Apache · Apache Tomcat

Published 2003-09-19 · Updated 2022-04-30 · CVE-2002-1567

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat version 4.1

Description The issue allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script. This occurs because the unmodified requested URL is included in the 404 response header, and new lines in this URL appear to the client as the end of the header section. As a result, the remaining part of the URL, including the script elements, is treated as part of the response body, and the client executes the script.

Recommendations For Apache Tomcat version 4.1, consider updating to a version where Tomcat replaces potentially unsafe characters in the response headers with spaces to prevent the execution of arbitrary scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2002-1567

GHSA-86FP-JGWM-WGJ5

Affected Products

Apache Tomcat

References · 14

• 🔥 https://exploit-db.com/exploits/21734 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vuln-dev/2002-q3/0482.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1567 · Security Note
• https://osv.dev/vulnerability/GHSA-86fp-jgwm-wgj5 · Vendor Advisory
• https://web.archive.org/web/20041213160616/http://archives.neohapsis.com/archives/vuln-dev/2002-q3/0482.html · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Note
• https://tomcat.apache.org/security-4 · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1567 · Note
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E · Note
• http://tomcat.apache.org/security-4.html · Note