PT-2003-1328 · Apache+1 · Jakarta Tomcat+2

Published 2003-02-07 · Updated 2022-04-29 · CVE-2003-0043

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat versions prior to 3.3.1a

Description The issue allows remote attackers to read portions of some files through the web.xml file, as it is processed with trusted privileges when used with JDK 1.3.1 or earlier. This enables files outside of the web application to be read, even when running under a security manager.

Recommendations For Jakarta Tomcat versions prior to 3.3.1a, update to version 3.3.1a or later to resolve the issue.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2003-0043

DSA-246

GHSA-CVX5-7VC7-RG77

Affected Products

Apache Tomcat

Jdk

Jakarta Tomcat

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2003-0043 · Security Note
• https://osv.dev/vulnerability/GHSA-cvx5-7vc7-rg77 · Vendor Advisory
• http://debian.org/security/2003/dsa-246 · Vendor Advisory
• http://securityfocus.com/advisories/5111 · Vendor Advisory
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a · Vendor Advisory
• http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Vendor Advisory
• https://github.com/apache/tomcat · Note
• http://ciac.org/ciac/bulletins/n-060.shtml · Note
• https://web.archive.org/web/20140627151430/http://securityfocus.com/advisories/5111 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0043 · Note
• https://tomcat.apache.org/security-3 · Note
• https://web.archive.org/web/20030819144200/http://ciac.org/ciac/bulletins/n-060.shtml · Note
• https://web.archive.org/web/20030804165204/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · Note
• https://web.archive.org/web/20030810045410/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a · Note
• https://web.archive.org/web/20131213024606/http://securityfocus.com/bid/6722 · Note