Apache Tomcat Source Code Disclosure

CVE-2002-1148 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
—
Source code
Not specified
Published (advisory)
2022-04-30 18:20:37 UTC
Updated
2024-02-12 19:42:48 UTC
GitHub reviewed
2024-02-12 19:42:47 UTC
NVD published
2002-10-11

EPSS Score

Score Percentile
67.27% 98.57%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type Value
GHSA GHSA-jxcv-v856-j5vg ↗
CVE CVE-2002-1148 ↗

CWEs

CWE id Name
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.apache.tomcat:tomcat >= 4.0.0, <= 4.0.4 4.0.5 —
maven org.apache.tomcat:tomcat >= 4.1.0, <= 4.1.10 4.1.12 —

References

cvelogic Threat Intelligence