Published: 11/10/2002 Updated: 20/11/2024

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and previous versions allows remote malicious users to read source code for server files via a direct request to the servlet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 3.0
apache tomcat 3.1
apache tomcat 3.1.1
apache tomcat 3.2
apache tomcat 3.2.1
apache tomcat 3.2.2
apache tomcat 3.2.3
apache tomcat 3.2.4
apache tomcat 3.3
apache tomcat 3.3.1
apache tomcat 4.0.0
apache tomcat 4.0.1
apache tomcat 4.0.2
apache tomcat 4.0.3
apache tomcat 4.0.4
apache tomcat 4.1.0
apache tomcat 4.1.3
apache tomcat 4.1.9
apache tomcat 4.1.10

A security vulnerability has been found in all Tomcat 4x releases This problem allows an attacker to use a specially crafted URL to return the unprocessed source code of a JSP page, or, under special circumstances, a static resource which would otherwise have been protected by security constraints, without the need for being properly authenticate ...

source: wwwsecurityfocuscom/bid/5786/info The servlet 'orgapachecatalinaservletsDefaultServlet' is included with Apache Tomcat by default It is possible to use this servlet to view contents of files within the webroot This includes JSP source code, which may contain sensitive data such as database usernames and passwords ta ...

https://nvd.nist.gov https://www.debian.org/security/./dsa-170 https://www.exploit-db.com/exploits/21853/

CVE-2002-1148

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect