PT-2003-1327 · Apache · Jakarta Tomcat+1

Jouko Pynnönen · Published 2003-01-29 · Updated 2022-04-29 · CVE-2003-0042

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat versions prior to 3.3.1a

Description The issue allows remote attackers to list directories even when an index.html or other file is present, or obtain unprocessed source code for a JSP file. This can be achieved via a URL containing a null character. URLs with null characters could result in file contents being returned or a directory listing being returned even when a welcome file was defined.

Recommendations For Jakarta Tomcat versions prior to 3.3.1a, update to version 3.3.1a or later to resolve the issue. As a temporary workaround, consider restricting access to URLs containing null characters to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2003-0042

DSA-246

GHSA-QFW2-WVRW-MVW4

Affected Products

Apache Tomcat

Jakarta Tomcat

References · 16

• 🔥 https://exploit-db.com/exploits/22205 · Exploit
• http://securityfocus.com/advisories/5111 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qfw2-wvrw-mvw4 · Vendor Advisory
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Vendor Advisory
• http://debian.org/security/2003/dsa-246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0042 · Security Note
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0042 · Note
• http://secunia.com/advisories/7977 · Note
• http://ciac.org/ciac/bulletins/n-060.shtml · Note
• https://tomcat.apache.org/security-3 · Note
• http://secunia.com/advisories/7972 · Note
• http://securityfocus.com/bid/6721 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11194 · Note